VideoLAN vulnerabilities
We track 7 vulnerabilities in VideoLAN products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
Latest VideoLAN vulnerabilities
- 7.8 High severity
vlc: Improper Limitation of a Pathname to a Restricted Directory
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC
- 7.0 High severity
VLC media player: Integer Overflow or Wraparound
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC proc
- 8.0 High severity
vlc_media_player: Heap-based Buffer Overflow
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC
- 8.8 High severity
dav1d: Integer Overflow or Wraparound
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
- 7.8 High severity
vlc_media_player: Uncontrolled Search Path Element
A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated privileges out of a standard user writable location. Standard users may use this to gain arbitrary cod
- 9.8 Critical severity
Vlc Media Player: Out-of-bounds Write
Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption.
- 7.8 High severity
Vlc Media Player: Integer Overflow or Wraparound
An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.