Monday, June 16, 2025
HomeComputer SecurityVideoLAN Fixed 13 VLC Media Player Vulnerabilities that allow Attackers to Execute...

VideoLAN Fixed 13 VLC Media Player Vulnerabilities that allow Attackers to Execute Arbitrary Code Remotely

Published on

SIEM as a Service

Follow Us on Google News

VideoLAN has released VLC 3.0.8 with the fix for 13 security vulnerabilities that allows a remote attacker to crash the VLC player and to execute arbitrary code on the machine with the user privileges.

The release fixes 13 security vulnerabilities that include 5 buffer overflows, null after free, null dereference and division by zero vulnerability.

These vulnerabilities can be exploited by using a maliciously crafted file and the user needs to open the file for successful exploitation.

- Advertisement - Google News

Affected versions and Workarounds

The vulnerabilities affected VLC media player 3.0.7.1 and earlier versions.

Out of other vulnerabilities “CVE-2019-13602 & CVE-2019-13962 mention a base score of 8.8 and 9.8 respectively, the VideoLAN team believes this severity is highly exagerated; in our opinion, a base score of 4.3 would be more reasonable.

It is recommended to update with 3.0.8 to addresses the issues, if you are unable to update then it is recommended not to “open files from untrusted third parties or accessing untrusted remote sites (or disable the VLC browser plugins) until the patch is applied.”

VLC is a free open-source cross-platform media player software available for desktop operating systems and mobile platforms. The framework supports various multimedia files and streaming protocols.

Other Fixes – VLC 3.0.8

  • VLC 3.0.8 is the eight update of “Vetinari”:
  • Fix stuttering for low framerate videos
  • Improve adaptive streaming support
  • Fix WebVTT subtitles rendering
  • Improve audio output on macOS &iOS

VLC Media Player 3.0.7.1 was released last month with the fix for a critical vulnerability that let hackers execute arbitrary code

Sponsored:  – Manage all the Endpoint networks from a single Console.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...