Description
Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vlc | 0.8.6.h-5 | — |
| Debian 13 | vlc | 0.8.6.h-5 | — |
| Debian 12 | vlc | 0.8.6.h-5 | — |
| Debian 5.0 | vlc | 0.8.6.h-4+lenny2 | DTSA-176-1 |
| Debian 4.0 | vlc | 0.8.6-svn20061012.debian-5.1+etch3 | DSA-1819-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- VideoLAN VLC Media Player < 0.9.6 - 'CUE' Local Buffer Overflow (PoC) EDB-9686 · dos · Sep 15, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- DSA-1819-1 vlc - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-176-1 vlc - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20081105 VideoLAN security advisory 0810 mailing-list
- vlcmediaplayer-cue-bo(46375) vdb-entry
- http://www.videolan.org/security/sa0810.html
- 20081106 [TKADV2008-012] VLC media player cue Processing Stack Overflow Vulnerability mailing-list
- [oss-security] 20081105 CVE id request: vlc mailing-list
- [oss-security] 20081110 Re: CVE id request: vlc mailing-list
- http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=5f63f1562d43f32331006c2c1a61742de031b84d
- oval:org.mitre.oval:def:14798 vdb-entry signature
- 32569 third-party-advisory
- http://www.trapkit.de/advisories/TKADV2008-012.txt
- 33315 third-party-advisory
- 32125 vdb-entry
- GLSA-200812-24 vendor-advisory