Buffer Overflow Vulnerability in VideoLAN VLC Media Player
CVE-2021-25802

7.1HIGH

Key Information:

Vendor

Videolan
Status
Vlc Media Player
Vendor
CVE Published:
26 July 2021

What is CVE-2021-25802?

A buffer overflow vulnerability exists in the AVI_ExtractSubtitle component of VideoLAN's VLC Media Player version 3.0.11. This flaw can be exploited by attackers to perform an out-of-bounds read by using a specially crafted .avi file. Such exploitation may lead to unexpected behavior or potential data leaks. Users are urged to update to the latest version to mitigate risks associated with this vulnerability.

References

https://code.videolan.org/videolan/vlc-3.0/-/commit/0660a...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.