CVE-2014-9597

The picture_pool_Delete function in misc/picture_pool.c in VideoLAN VLC media player 2.1.5 allows...

6.8 MediumPublic exploitFix available

The picture_pool_Delete function in misc/picture_pool.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service (DEP violation and application crash) via a crafted FLV file.

Exploit likelihood

6.63%Down 3.3 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2014-9597
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-9597
Updated: 2026-11-02

EUVDEUVD-2014-9411 No score

Record: EUVD-2014-9411
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wmf4-pgrw-pc73 No score

The picture_pool_Delete function in misc/picture_pool.c in VideoLAN VLC media player 2.1.5 allows...

Record: GHSA-wmf4-pgrw-pc73
Weakness: CWE-20
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-9597 No score

Record: UBUNTU-CVE-2014-9597
Updated: 2026-11-02

Affected products

videolan vlc media player

Affected packages

Affected packages
Package	Affected	Fixed
`vlc` Ubuntu:14.04:LTS	before 2.1.6-0ubuntu14.04.2, plus listed versions 2.0.8-12.1.1-12.1.2-12.1.2-22.1.2-2build12.1.2-2build22.1.4-0ubuntu14.04.12.1.6-0ubuntu14.04.1	2.1.6-0ubuntu14.04.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	VideoLAN VLC Media Player 2.1.5 - DEP Access Violation	2015-01-26

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9597 is a medium vulnerability (CVSS 6.8) in Videolan Vlc Media Player, published January 21, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.63%, the 93rd percentile. Fixed in vlc 2.1.6-0ubuntu14.04.2.