Read the docs
TI-2007-05971 Aliases CVE-2007-6262GHSA-crj9-mr7m-c86x

A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote…

Priority MEDIUM 43CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVariable function, resulting from a "bad initialized pointer," aka a "recursive plugin release vulnerability."

Why it matters now

EPSS 0.11115 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*0.8.6VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6a:*:*:*:*:*:*:*0.8.6aVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6b:*:*:*:*:*:*:*0.8.6bVulnerableVideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:* Versions 0.8.6 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6a:*:*:*:*:*:*:* Versions 0.8.6a Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6b:*:*:*:*:*:*:* Versions 0.8.6b Vulnerable ·VideoLAN

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2007-6262
  2. 2026-10-03 Alias added: GHSA-crj9-mr7m-c86x

References

Advisory 1

Other 4

  • TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
  • TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
  • TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
  • TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
  • TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
  • TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3
See all 112 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences