Description
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vlc | 1.1.8-1 | — |
| Debian 13 | vlc | 1.1.8-1 | — |
| Debian 12 | vlc | 1.1.8-1 | — |
| Debian 6.0 | vlc | 1.1.3-1squeeze4 | DSA-2211-1 |
| Debian 5.0 | vlc | 0.8.6.h-4+lenny3 | DSA-2211-1 |
Advisories 1
- DSA-2211-1 vlc - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1025250 vdb-entry
- oval:org.mitre.oval:def:14873 vdb-entry signature
- ADV-2011-0759 vdb-entry
- http://www.videolan.org/vlc/releases/1.1.8.html
- 43826 third-party-advisory
- http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files
- DSA-2211 vendor-advisory
- 20110323 CORE-2011-0208: VLC Vulnerabilities handling .AMV and .NSV files mailing-list
- vlcmediaplayer-nsv-bo(66260) vdb-entry
- 8162 third-party-advisory
- 71278 vdb-entry
- 47012 vdb-entry