Read the docs
TI-2017-05875 Aliases CVE-2017-8310GHSA-2ggh-fcw2-8mvr

Out-of-bounds read in VideoLAN VLC

Priority LOW 27CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file.

Why it matters now

EPSS 0.01264 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VideoLANVLCall versions—No fix listedCNA
  • VLC VendorVideoLAN Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:videolan:vlc_media_player:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableVideoLAN
cpe:2.3:a:videolan:vlc_media_player:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableVideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·VideoLAN
  • cpe:2.3:a:videolan:vlc_media_player:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·VideoLAN

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    VideoLAN VLC — DSA-3899

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    Show all 4 records → Advisory →
  • Advisory ·

    VideoLAN VLC — GLSA-201707-10

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-8310
  2. 2026-10-03 Alias added: GHSA-2ggh-fcw2-8mvr

References

Advisory 2

Other 1

  • TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
  • TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
  • TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
  • TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
  • TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
  • TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3
See all 112 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences