CVE-2017-8311
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping...
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
CVE-2017-8311- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
CVE-2017-8311- Updated
- 2026-11-02
EUVDEUVD-2017-17272 No score
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
EUVD-2017-17272- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3gx-7f25-5jxg
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping...
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
GHSA-h3gx-7f25-5jxg- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
CVE-2017-8311- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-8311
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
DEBIAN-CVE-2017-8311- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-8311
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
UBUNTU-CVE-2017-8311- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 2.2.5-1 | 2.2.5-1 |
vlcDebian:13 |
before 2.2.5-1 | 2.2.5-1 |
vlcDebian:14 |
before 2.2.5-1 | 2.2.5-1 |
vlcDebian:8 |
before 2.2.6-1~deb8u1, plus listed versions 2.2.0-12.2.0~rc2-22.2.0~rc2-2+deb8u12.2.1-12.2.1-1~deb8u1 Show 35 moreShow less2.2.1-22.2.1-32.2.1-42.2.1-52.2.2-12.2.2-22.2.2-32.2.2-42.2.2-52.2.2-62.2.3-12.2.3-22.2.4-12.2.4-102.2.4-112.2.4-122.2.4-132.2.4-142.2.4-1~deb8u12.2.4-22.2.4-32.2.4-42.2.4-52.2.4-62.2.4-72.2.4-82.2.4-92.2.5-12.2.5-1~deb8u12.2.5-22.2.5-32.2.5-42.2.5.1-12.2.5.1-1~deb9u12.2.5.1-1~deb9u2 |
2.2.6-1~deb8u1 |
vlcUbuntu:14.04:LTS |
before 2.1.6-0ubuntu14.04.3, plus listed versions 2.0.8-12.1.1-12.1.2-12.1.2-22.1.2-2build1 Show 4 moreShow less2.1.2-2build22.1.4-0ubuntu14.04.12.1.6-0ubuntu14.04.12.1.6-0ubuntu14.04.2 |
2.1.6-0ubuntu14.04.3 |
vlcUbuntu:16.04:LTS |
before 2.2.2-5ubuntu0.16.04.3, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 5 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.2 |
2.2.2-5ubuntu0.16.04.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | VLC Media Player/Kodi/PopcornTime 'Red Chimera' < 2.2.5 - Memory Corruption (PoC) | 2018-04-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-8311 is a high vulnerability (CVSS 7.8) in Videolan Vlc, published May 23, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.77%, the 95th percentile. Fixed in vlc 2.2.5-1.