Skip to content
OpenAdvisories
High USN-6180-1 7 CVEs

vlc vulnerabilities

Published Jun 20, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that VLC could be made to read out of bounds when
decoding image files. If a user were tricked into opening a crafted image
file, a remote attacker could possibly use this issue to cause VLC to
crash, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-19721)

It was discovered that VLC could be made to write out of bounds when
processing H.264 video files. If a user were tricked into opening a
crafted H.264 video file, a remote attacker could possibly use this issue
to cause VLC to crash, leading to a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2020-13428)

It was discovered that VLC could be made to read out of bounds when
processing AVI video files. If a user were tricked into opening a crafted
AVI video file, a remote attacker could possibly use this issue to cause
VLC to crash, leading to a denial of service. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-25801,
CVE-2021-25802, CVE-2021-25803, CVE-2021-25804)

It was discovered that the VNC module of VLC contained an arithmetic
overflow. If a user were tricked into opening a crafted playlist or
connecting to a rouge VNC server, a remote attacker could possibly use
this issue to cause VLC to crash, leading to a denial of service, or
possibly execute arbitrary code. (CVE-2022-41325)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS vlc 2.2.2-5ubuntu0.16.04.5+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS vlc 3.0.8-0ubuntu18.04.1+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS vlc 3.0.9.2-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS vlc 3.0.16-1ubuntu0.1~esm1

Vulnerabilities 7

  • High 7.8
    CVE-2022-41325

    An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a use…

    vlc vlc vlc Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-19721

    An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows r…

    vlc vlc vlc Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-13428

    A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media …

    vlc vlc vlc Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-25801 Public exploit

    A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to c…

    vlc vlc Debian Ubuntu
  • Unscored —
    CVE-2021-25802

    A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attacke…

    vlc vlc Debian Ubuntu
  • Unscored —
    CVE-2021-25803

    A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows at…

    vlc vlc Debian Ubuntu
  • Unscored —
    CVE-2021-25804 Public exploit

    A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the …

    vlc vlc Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2019-19721
  • report
    https://ubuntu.com/security/CVE-2020-13428
  • report
    https://ubuntu.com/security/CVE-2021-25801
  • report
    https://ubuntu.com/security/CVE-2021-25802
  • report
    https://ubuntu.com/security/CVE-2021-25803
  • report
    https://ubuntu.com/security/CVE-2021-25804
  • report
    https://ubuntu.com/security/CVE-2022-41325