Read the docs
TI-2010-01397 Aliases CVE-2010-1443GHSA-3g28-22mv-7m5h

The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist…

Priority LOW 28Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty location element in an XML Shareable Playlist Format (XSPF) document.

Why it matters now

EPSS 0.02448 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*up to 1.0.5VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*0.5.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:*0.5.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:*0.5.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*0.5.3VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*0.6.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:*0.6.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*0.6.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*0.7.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.7.1:*:*:*:*:*:*:*0.7.1VulnerableVideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:* Versions up to 1.0.5 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:* Versions 0.5.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:* Versions 0.5.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:* Versions 0.5.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:* Versions 0.5.3 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:* Versions 0.6.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:* Versions 0.6.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·VideoLAN
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*0.7.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*0.8.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*0.8.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*0.8.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*0.8.4VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.4a:*:*:*:*:*:*:*0.8.4aVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*0.8.5VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*0.8.6VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6a:*:*:*:*:*:*:*0.8.6aVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6b:*:*:*:*:*:*:*0.8.6bVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6c:*:*:*:*:*:*:*0.8.6cVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6d:*:*:*:*:*:*:*0.8.6dVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6e:*:*:*:*:*:*:*0.8.6eVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6f:*:*:*:*:*:*:*0.8.6fVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6g:*:*:*:*:*:*:*0.8.6gVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6h:*:*:*:*:*:*:*0.8.6hVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.6i:*:*:*:*:*:*:*0.8.6iVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.8.1337:*:*:*:*:*:*:*0.8.1337VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.0:*:*:*:*:*:*:*0.9.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.1:*:*:*:*:*:*:*0.9.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*0.9.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*0.9.3VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*0.9.4VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*0.9.5VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:*0.9.6VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:*0.9.8aVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:*0.9.9VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.9a:*:*:*:*:*:*:*0.9.9aVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:*0.9.10VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableVideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:* Versions 0.7.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:* Versions 0.8.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:* Versions 0.8.4 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.4a:*:*:*:*:*:*:* Versions 0.8.4a Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:* Versions 0.8.6 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6a:*:*:*:*:*:*:* Versions 0.8.6a Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6b:*:*:*:*:*:*:* Versions 0.8.6b Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6c:*:*:*:*:*:*:* Versions 0.8.6c Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6d:*:*:*:*:*:*:* Versions 0.8.6d Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6e:*:*:*:*:*:*:* Versions 0.8.6e Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6f:*:*:*:*:*:*:* Versions 0.8.6f Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6g:*:*:*:*:*:*:* Versions 0.8.6g Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6h:*:*:*:*:*:*:* Versions 0.8.6h Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.6i:*:*:*:*:*:*:* Versions 0.8.6i Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.8.1337:*:*:*:*:*:*:* Versions 0.8.1337 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:* Versions 0.9.5 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:* Versions 0.9.8a Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:* Versions 0.9.9 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.9a:*:*:*:*:*:*:* Versions 0.9.9a Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:* Versions 0.9.10 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·VideoLAN

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-1443
  2. 2026-10-03 Alias added: GHSA-3g28-22mv-7m5h

References

Advisory 1

Other 2

  • TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
  • TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
  • TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
  • TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
  • TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
  • TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3
See all 112 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences