TI-2017-05878 Aliases CVE-2017-8313 GHSA-x47q-49w5-cg3q

Out-of-bounds read in VideoLAN VLC

LOW 28CWE-125Published 2017-05-23 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.

Why it matters now

EPSS 0.01481 74th percentileScored 2026-11-07

Fix Fixed VLC (VideoLAN): 2.2.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VideoLAN	VLC	before 2.2.5	2.2.5	Patch available	CNA

VLC VendorVideoLAN Affected before 2.2.5 Fixed in 2.2.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:videolan:vlc_media_player::::::::	up to 2.2.4	Vulnerable	VideoLAN

cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:* Versions up to 2.2.4 Vulnerable ·VideoLAN

Remediation

Fix · CNA VLC (VideoLAN) Fixed in 2.2.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2017-05-23
VideoLAN VLC — DSA-3899
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2017-05876 Memory corruption in VideoLAN VLCPriority MEDIUM 45
- TI-2017-05877 Out-of-bounds read in VideoLAN VLCPriority LOW 28
- TI-2017-05875 Out-of-bounds read in VideoLAN VLCPriority LOW 27
Show all 4 records → Advisory →
Advisory · 2017-05-23
VideoLAN VLC — GLSA-201707-10
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2017-05876 Memory corruption in VideoLAN VLCPriority MEDIUM 45
- TI-2017-05877 Out-of-bounds read in VideoLAN VLCPriority LOW 28
- TI-2017-05875 Out-of-bounds read in VideoLAN VLCPriority LOW 27
Show all 4 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2017-8313
2026-10-03 Alias added: GHSA-x47q-49w5-cg3q

References

Advisory 2

Other 1

http://git.videolan.org/?p=vlc/vlc-2.2.git%3Ba=commitdiff%3Bh=05b653355ce303ada3b5e0e645ae717fea39186c

TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3

See all 112 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences