TI-2017-05876 Aliases CVE-2017-8311 GHSA-h3gx-7f25-5jxg

Memory corruption in VideoLAN VLC

MEDIUM 45CWE-119Published 2017-05-23 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.

Why it matters now

EPSS 0.08765 95th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed VLC (VideoLAN): 2.2.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VideoLAN	VLC	before 2.2.5	2.2.5	Patch available	CNA

VLC VendorVideoLAN Affected before 2.2.5 Fixed in 2.2.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:videolan:vlc_media_player::::::::	up to 2.2.4	Vulnerable	VideoLAN

cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:* Versions up to 2.2.4 Vulnerable ·VideoLAN

Remediation

Fix · CNA VLC (VideoLAN) Fixed in 2.2.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2017-05-23
VideoLAN VLC — DSA-3899
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2017-05878 Out-of-bounds read in VideoLAN VLCPriority LOW 28
- TI-2017-05877 Out-of-bounds read in VideoLAN VLCPriority LOW 28
- TI-2017-05875 Out-of-bounds read in VideoLAN VLCPriority LOW 27
Show all 4 records → Advisory →
Advisory · 2017-05-23
VideoLAN VLC — GLSA-201707-10
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2017-05878 Out-of-bounds read in VideoLAN VLCPriority LOW 28
- TI-2017-05877 Out-of-bounds read in VideoLAN VLCPriority LOW 28
- TI-2017-05875 Out-of-bounds read in VideoLAN VLCPriority LOW 27
Show all 4 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2017-8311
2026-10-03 Alias added: GHSA-h3gx-7f25-5jxg

References

Exploit 1

44514

Advisory 2

Other 1

http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=775de716add17322f24b476439f903a829446eb6

TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3

See all 112 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences