Heap Buffer Overflow Vulnerability in VLC Package
Summary
OSV-2025-614: Heap-buffer-overflow in hevc_hvcC_to_AnnexB_NAL. Affects vlc versions >= f8e9d090fc20452cfddb91df28bf235eb59baff1, < e7396baa09fa844e6ef2efaa91b6ad4cac706fd4. Fixed in e7396baa09fa844e6ef2efaa91b6ad4cac706fd4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
VLC is a widely used open-source media player developed by the VideoLAN project. It supports various audio and video formats and is known for its versatility and user-friendly interface. However, like many software applications, VLC can be susceptible to vulnerabilities, including memory management issues that can lead to crashes or exploitation.
Vulnerability Detail
The vulnerability identified is a heap buffer overflow occurring in the function hevc_hvcC_to_AnnexB_NAL. This issue arises from improper handling of memory allocation, which can lead to a crash or potentially allow an attacker to execute arbitrary code. The vulnerability was reported through OSS-Fuzz, highlighting its severity as high due to the potential impact on user systems.
How To Fix
Minimum fixed version
e7396baa09fa844e6ef2efaa91b6ad4cac706fd4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functionality that triggers the vulnerability until the patch is applied. This may involve refraining from opening certain media files that utilize the HEVC codec until the update is completed.
Conclusion
The heap buffer overflow vulnerability in VLC poses a significant risk to users, but it can be mitigated by updating to the latest patched version. Users are encouraged to stay informed about vulnerabilities and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for vlc →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to crashes or security vulnerabilities.
You can check your VLC version by opening the application and navigating to Help > About. Compare your version with the patched version mentioned in the vulnerability report.
Yes, you can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If you cannot update VLC right away, consider using alternative media players or avoiding the use of HEVC files until the vulnerability is patched.
Detailed information about this vulnerability can be found in the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for vlc.
