Global Buffer Overflow Vulnerability in VLC Media Player
Summary
OSV-2025-764: Global-buffer-overflow in Ogg_CreateES. Affects vlc versions >= f8e9d090fc20452cfddb91df28bf235eb59baff1, < d9931019530b0e26ebe7f0cd1ce3eb33ad497f70. Fixed in d9931019530b0e26ebe7f0cd1ce3eb33ad497f70. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
VLC Media Player is a widely-used open-source multimedia player and framework that supports various audio and video formats. It is known for its versatility, user-friendly interface, and ability to play almost any media file without the need for additional codecs. However, like many software applications, VLC is susceptible to vulnerabilities that can compromise its security and functionality. The recent global buffer overflow vulnerability in the Ogg_CreateES function poses a significant risk to users, potentially leading to crashes or exploitation.
Vulnerability Detail
The vulnerability identified as OSV-2025-764 is a global buffer overflow occurring in the Ogg_CreateES function of VLC. This issue was reported through OSS-Fuzz, a service that finds vulnerabilities in open-source software. The crash type is categorized as a global buffer overflow during a read operation, which can lead to unauthorized access to memory and potentially allow an attacker to execute arbitrary code. The vulnerability was introduced in the commit f8e9d090fc20452cfddb91df28bf235eb59baff1 and was fixed in the commit d9931019530b0e26ebe7f0cd1ce3eb33ad497f70.
How To Fix
Minimum fixed version
d9931019530b0e26ebe7f0cd1ce3eb33ad497f70
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to update to the patched version as soon as it becomes available.
Conclusion
The global buffer overflow vulnerability in VLC Media Player poses a significant risk to users, potentially leading to crashes and exploitation. It is crucial for users to update to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of open-source applications.
See every vulnerability recorded for vlc →
FAQ
A global buffer overflow is a type of vulnerability where a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior or security breaches.
You can check your VLC version by opening the application and navigating to 'Help' > 'About'. Compare your version with the fixed version mentioned in the vulnerability report.
If you cannot update VLC immediately, it is advisable to limit the use of the application until a patch is applied, especially when handling untrusted media files.
More information can be found in the OSS-Fuzz report linked in the vulnerability details, which provides insights into the crash state and technical specifics.
Vulert monitors and alerts users in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for vlc.
