Read the docs
TI-2010-02810 Aliases CVE-2010-2937GHSA-h79h-2326-9h3v

The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media…

Priority LOW 28CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags, which allows remote attackers to cause a denial of service (application crash) via a crafted media file.

Why it matters now

EPSS 0.02638 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:videolan:vlc_media_player:0.9.0:*:*:*:*:*:*:*0.9.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.1:*:*:*:*:*:*:*0.9.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*0.9.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*0.9.3VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*0.9.4VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*0.9.5VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:*0.9.6VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.7:*:*:*:*:*:*:*0.9.7VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:*0.9.8aVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:*0.9.9VulnerableVideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:* Versions 0.9.5 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.7:*:*:*:*:*:*:* Versions 0.9.7 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:* Versions 0.9.8a Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:* Versions 0.9.9 Vulnerable ·VideoLAN
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:videolan:vlc_media_player:0.9.9a:*:*:*:*:*:*:*0.9.9aVulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:*0.9.10VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.5:*:*:*:*:*:*:*1.0.5VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.0.6:*:*:*:*:*:*:*1.0.6VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableVideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.9a:*:*:*:*:*:*:* Versions 0.9.9a Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:* Versions 0.9.10 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·VideoLAN

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-2937
  2. 2026-10-03 Alias added: GHSA-h79h-2326-9h3v

References

Advisory 1

Other 4

  • TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
  • TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
  • TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
  • TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
  • TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
  • TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3
See all 112 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences