Integer Underflow Vulnerability in VLC Media Player by VideoLAN

CVE-2014-9626

What is CVE-2014-9626?

An integer underflow vulnerability exists in the MP4_ReadBox_String function within the VLC Media Player, specifically in the demux module. An attacker could exploit this vulnerability by providing a crafted MP4 file with a box size less than 7, which may lead to denial of service conditions. The potentially exploitable flaw could also result in other unspecified impacts, affecting the functionality and stability of the player, particularly prior to version 2.1.6. Users are advised to update their VLC Media Player to the latest version to mitigate risks.

References