CVE-2018-11529
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can...
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
- Record
CVE-2018-11529- CVSS 3.0
- 8.0 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
- Record
CVE-2018-11529- Updated
- 2026-11-02
EUVDEUVD-2018-3558 No score
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
- Record
EUVD-2018-3558- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j4p7-jwxh-8774
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can...
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
- Record
GHSA-j4p7-jwxh-8774- CVSS 3.0
- 8.0 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
- Record
CVE-2018-11529- CVSS 3.0
- 8.0 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11529
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
- Record
DEBIAN-CVE-2018-11529- CVSS 3.0
- 8.0 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11529
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
- Record
UBUNTU-CVE-2018-11529- CVSS 3.0
- 8.0 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0400 No score
Updated vlc packages fix security vulnerability
This update provides vlc 3.0.4 and fixes at least the following security issue:
A use-after-free was discovered in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played (CVE-2018-11529)
For other fixes in this update, see the referenced NEWS.
- Record
MGASA-2018-0400- Updated
- 2026-11-02
OSVUSN-4805-1 No score
vlc vulnerabilities
It was discovered that VLC mishandled certain crafted media files. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2017-10699)
It was discovered that VLC mishandled certain crafted MKV files. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. (CVE-2018-11529)
- Record
USN-4805-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 3.0.3-1-1 | 3.0.3-1-1 |
vlcDebian:13 |
before 3.0.3-1-1 | 3.0.3-1-1 |
vlcDebian:14 |
before 3.0.3-1-1 | 3.0.3-1-1 |
vlcDebian:9 |
before 3.0.3-1-0+deb9u1, plus listed versions 2.2.6-12.2.6-1~deb9u12.2.6-22.2.6-32.2.6-4 Show 33 moreShow less2.2.6-52.2.6-62.2.7-12.2.7-1~deb8u12.2.7-1~deb9u12.2.8-12.2.8-23.0.0-13.0.0~rc1-13.0.0~rc1~20171206-13.0.0~rc1~20171210-13.0.0~rc1~20171210-23.0.0~rc2-13.0.0~rc2-23.0.0~rc4-13.0.0~rc4-23.0.0~rc4-33.0.0~rc5-13.0.0~rc6-13.0.0~rc7-13.0.0~rc7-23.0.0~rc8-13.0.1-13.0.1-23.0.1-33.0.2-0+deb9u13.0.2-13.0.2-1+0.riscv64.13.0.2-1+0.riscv64.23.0.3-13.0.3-1+0.riscv64.13.0.3-1+b1+0.riscv64.13.0.3-2 |
3.0.3-1-0+deb9u1 |
vlcMageia:6 |
before 3.0.4-1.mga6 | 3.0.4-1.mga6 |
vlcMageia:6 |
before 3.0.4-1.mga6.tainted | 3.0.4-1.mga6.tainted |
vlcUbuntu:Pro:14.04:LTS |
before 2.1.6-0ubuntu14.04.5+esm1, plus listed versions 2.0.8-12.1.1-12.1.2-12.1.2-22.1.2-2build1 Show 7 moreShow less2.1.2-2build22.1.4-0ubuntu14.04.12.1.6-0ubuntu14.04.12.1.6-0ubuntu14.04.22.1.6-0ubuntu14.04.32.1.6-0ubuntu14.04.42.1.6-0ubuntu14.04.5 |
2.1.6-0ubuntu14.04.5+esm1 |
vlcUbuntu:Pro:16.04:LTS |
before 2.2.2-5ubuntu0.16.04.5+esm1, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 7 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.4 |
2.2.2-5ubuntu0.16.04.5+esm1 |
vlcUbuntu:Pro:14.04:LTS From an advisory covering 2 CVEs |
before 2.1.6-0ubuntu14.04.5+esm1, plus listed versions 2.0.8-12.1.1-12.1.2-12.1.2-22.1.2-2build1 Show 7 moreShow less2.1.2-2build22.1.4-0ubuntu14.04.12.1.6-0ubuntu14.04.12.1.6-0ubuntu14.04.22.1.6-0ubuntu14.04.32.1.6-0ubuntu14.04.42.1.6-0ubuntu14.04.5 |
2.1.6-0ubuntu14.04.5+esm1 |
vlcUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 2.2.2-5ubuntu0.16.04.5+esm1, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 7 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.4 |
2.2.2-5ubuntu0.16.04.5+esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | VLC Media Player MKV Use After Free | 2018-05-24 |
| Exploit-DB | VLC Media Player - MKV Use-After-Free (Metasploit) | 2018-10-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11529 is a high vulnerability (CVSS 8.0) in Videolan Vlc Media Player, published July 11, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 40.5%, the 98th percentile. Fixed in vlc 3.0.3-1-1.
References
securitytracker.com/id/1041311
seclists.org/fulldisclosure/2018/Jul/28
exploit-db.com/exploits/45626
debian.org/security/2018/dsa-4251
nvd.nist.gov/vuln/detail/CVE-2018-11529
github.com/advisories/GHSA-j4p7-jwxh-8774
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2018-11529
advisories.mageia.org/MGASA-2018-0400.html
bugs.mageia.org/show_bug.cgi?id=23092
videolan.org/developers/vlc-branch/NEWS
ubuntu.com/security/CVE-2018-11529
cve.org/CVERecord?id=CVE-2018-11529