Heap Buffer Overflow Vulnerability in VLC Media Player
Summary
OSV-2025-622: Heap-buffer-overflow in cc_storage_append. Affects vlc versions >= f8e9d090fc20452cfddb91df28bf235eb59baff1, < e7396baa09fa844e6ef2efaa91b6ad4cac706fd4. Fixed in e7396baa09fa844e6ef2efaa91b6ad4cac706fd4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
VLC Media Player is a widely used open-source multimedia player and framework that plays most multimedia files, as well as DVDs, audio CDs, VCDs, and various streaming protocols. It is known for its versatility and support for a wide range of audio and video formats. However, like many software applications, VLC is not immune to vulnerabilities. The specific issue at hand is a heap buffer overflow that can lead to crashes and potential exploitation.
Vulnerability Detail
The vulnerability identified as OSV-2025-622 is a heap buffer overflow occurring in the function cc_storage_append. This issue arises during the parsing of SEI (Supplemental Enhancement Information) data, which can lead to a crash of the application. The crash type is categorized as a 'Heap-buffer-overflow READ 1', indicating that the application attempts to read beyond the allocated memory buffer. This vulnerability can potentially be exploited to execute arbitrary code or cause denial of service, making it a significant concern for users of VLC.
How To Fix
Minimum fixed version
e7396baa09fa844e6ef2efaa91b6ad4cac706fd4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening files that may trigger this vulnerability until they have updated to the patched version. Additionally, users can disable certain features related to SEI parsing if possible, though this may limit functionality.
Conclusion
The heap buffer overflow vulnerability in VLC Media Player poses a significant risk to users, potentially leading to application crashes and exploitation. It is crucial for users to update to the patched version to mitigate this risk. Awareness of such vulnerabilities and utilizing tools like Vulert can enhance security practices.
See every vulnerability recorded for vlc →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it was allocated for, potentially overwriting adjacent memory and leading to unpredictable behavior.
You can check your VLC version by opening the application and navigating to Help > About. If your version falls within the introduced range specified in the vulnerability details, it is affected.
While the primary concern is application crashes and potential exploitation, there is a risk of data loss if the application crashes while processing important media files.
Yes, if an attacker can convince a user to open a specially crafted media file, they may exploit this vulnerability remotely.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for vlc.
