Description
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mplayer | 1.0~rc2-19 | — |
| Debian 13 | mplayer | 1.0~rc2-19 | — |
| Debian 12 | mplayer | 1.0~rc2-19 | — |
| Debian 5.0 | mplayer | 1.0~rc2-17+lenny2 | DTSA-181-1 |
| Debian 4.0 | mplayer | 1.0~rc1-12etch7 | DSA-1782-1 |
Advisories 2
- DSA-1782-1 mplayer - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-181-1 mplayer - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 34845 third-party-advisory
- MDVSA-2009:014 vendor-advisory
- MDVSA-2009:013 vendor-advisory
- 32822 vdb-entry
- 20081214 [TKADV2008-014] MPlayer TwinVQ Processing Stack Buffer Overflow Vulnerability mailing-list
- http://svn.mplayerhq.hu/mplayer/branches/1.0rc2/libmpdemux/demux_vqf.c?r1=24723&r2=28150&pathrev=28150
- DSA-1782 vendor-advisory
- http://trapkit.de/advisories/TKADV2008-014.txt
- http://svn.mplayerhq.hu/mplayer/branches/1.0rc2/libmpdemux/demux_vqf.c?view=log&pathrev=28150#rev28150
- 33136 third-party-advisory