Buffer Overflow Vulnerability in VideoLAN VLC Media Player
CVE-2021-25801

7.1HIGH

Key Information:

Vendor
Videolan
Status
Vlc Media Player
Vendor
CVE Published:
26 July 2021

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A buffer overflow vulnerability exists in the __Parse_indx component of VideoLAN's VLC Media Player (version 3.0.11). This flaw allows attackers to exploit vulnerabilities in crafted .avi files, enabling potential out-of-bounds reads. Attackers can leverage this vulnerability to manipulate or disrupt media playback, posing security risks to users. Users are encouraged to update their VLC Media Player to mitigate any associated risks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

VLC_CVE-2021-25801_Analysis
Created by DShankle

References

https://code.videolan.org/videolan/vlc-3.0/-/commit/f5f8c...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.