CVE-2011-1684
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer...
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
- Record
CVE-2011-1684- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
- Record
CVE-2011-1684- Updated
- 2026-11-02
EUVDEUVD-2011-1684 No score
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
- Record
EUVD-2011-1684- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6fr2-3p5m-8x48 No score
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer...
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
- Record
GHSA-6fr2-3p5m-8x48- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
- Record
CVE-2011-1684- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1684 No score
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
- Record
DEBIAN-CVE-2011-1684- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1684 is a medium vulnerability (CVSS 6.8) in Videolan Vlc Media Player, published April 12, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.65%, the 91st percentile. Fixed in vlc 1.1.8-3.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14741
vupen.com/english/advisories/2011/0954
secunia.com/advisories/43890
openwall.com/lists/oss-security/2011/04/11/17
git.videolan.org?p=vlc.git%3Ba=commit%3Bh=5637ca8141bf39f263ecdb62035d2cb45c740821
Show 12 moreShow less
debian.org/security/2011/dsa-2218
exchange.xforce.ibmcloud.com/vulnerabilities/66664
securityfocus.com/bid/47293
securitytracker.com/id?1025373
videolan.org/security/sa1103.html
nvd.nist.gov/vuln/detail/CVE-2011-1684
github.com/advisories/GHSA-6fr2-3p5m-8x48
security-tracker.debian.org/tracker/CVE-2011-1684