Every CVE Search/ Get API key

CVE-2020-26664

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers...

7.8 HighFix available

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.50%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Record
CVE-2020-26664
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Record
CVE-2020-26664
Updated
2026-11-02
EUVDEUVD-2020-19206 No score

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Record
EUVD-2020-19206
Updated
2026-11-02
GitHub AdvisoriesGHSA-fv8f-3437-pw9x 7.8

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers...

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Record
GHSA-fv8f-3437-pw9x
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2020-26664 7.8

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Record
ALPINE-CVE-2020-26664
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 7.8

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Record
CVE-2020-26664
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2020-26664 7.8

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Record
DEBIAN-CVE-2020-26664
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-26664 7.8

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

Record
UBUNTU-CVE-2020-26664
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2021:0076-1 No score

Security update for vlc

This update for vlc fixes the following issues:

Update to 3.0.11.1:

  • CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727)
  • CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755)
Record
openSUSE-SU-2021:0076-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0091-1 No score

Security update for vlc

This update for vlc fixes the following issues:

Update to 3.0.11.1:

  • CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727)
  • CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755)
Record
openSUSE-SU-2021:0091-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0121-1 No score

Security update for vlc

This update for vlc fixes the following issues:

Update to 3.0.11.1:

  • CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727)
  • CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755)

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2021:0121-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0122-1 No score

Security update for vlc

This update for vlc fixes the following issues:

Update to 3.0.11.1:

  • CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727)
  • CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755)

This update was imported from the openSUSE:Leap:15.2:Update update project.

Record
openSUSE-SU-2021:0122-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0691-1 No score

Security update for vlc

This update for vlc fixes the following issues:

Update to version 3.0.13:

  • Demux:

    • Adaptive: fix artefacts in HLS streams with wrong profiles/levels
    • Fix regression on some MP4 files for the audio track
    • Fix MPGA and ADTS probing in TS files
    • Fix Flac inside AVI files
    • Fix VP9/Webm artefacts when seeking

  • Codec:

    • Support SSA text scaling
    • Fix rotation on Android rotation
    • Fix WebVTT subtitles that start at 00:00

  • Access:

    • Update libnfs to support NFSv4
    • Improve SMB2 integration
    • Fix Blu-ray files using Unicode names on Windows
    • Disable mcast lookups on Android for RTSP playback

  • Video Output: Rework the D3D11 rendering wait, to fix choppiness on display

  • Interfaces:

    • Fix VLC getting stuck on close on X11 (#21875)
    • Improve RTL on preferences on macOS
    • Add mousewheel horizontal axis control
    • Fix crash on exit on macOS
    • Fix sizing of the fullscreen controls on macOS

  • Misc:

    • Improve MIDI fonts search on Linux
    • Update Soundcloud, Youtube, liveleak
    • Fix compilation with GCC11
    • Fix input-slave option for subtitles

  • Updated translations.

Update to version 3.0.12:

  • Access: Add new RIST access module compliant with simple profile (VSF_TR-06-1).

  • Access Output: Add new RIST access output module compliant with simple profile (VSF_TR-06-1).

  • Demux: Fixed adaptive's handling of resolution settings.

  • Audio output: Fix audio distortion on macOS during start of playback.

  • Video Output: Direct3D11: Fix some potential crashes when using video filters.

  • Misc:

    • Several fixes in the web interface, including privacy and security improvements
    • Update YouTube and Vocaroo scripts.

  • Updated translations.

Record
openSUSE-SU-2021:0691-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0714-1 No score

Security update for vlc

This update for vlc fixes the following issues:

Update to version 3.0.13:

  • Demux:

    • Adaptive: fix artefacts in HLS streams with wrong profiles/levels
    • Fix regression on some MP4 files for the audio track
    • Fix MPGA and ADTS probing in TS files
    • Fix Flac inside AVI files
    • Fix VP9/Webm artefacts when seeking

  • Codec:

    • Support SSA text scaling
    • Fix rotation on Android rotation
    • Fix WebVTT subtitles that start at 00:00

  • Access:

    • Update libnfs to support NFSv4
    • Improve SMB2 integration
    • Fix Blu-ray files using Unicode names on Windows
    • Disable mcast lookups on Android for RTSP playback

  • Video Output: Rework the D3D11 rendering wait, to fix choppiness on display

  • Interfaces:

    • Fix VLC getting stuck on close on X11 (#21875)
    • Improve RTL on preferences on macOS
    • Add mousewheel horizontal axis control
    • Fix crash on exit on macOS
    • Fix sizing of the fullscreen controls on macOS

  • Misc:

    • Improve MIDI fonts search on Linux
    • Update Soundcloud, Youtube, liveleak
    • Fix compilation with GCC11
    • Fix input-slave option for subtitles

  • Updated translations.

Update to version 3.0.12:

  • Access: Add new RIST access module compliant with simple profile (VSF_TR-06-1).

  • Access Output: Add new RIST access output module compliant with simple profile (VSF_TR-06-1).

  • Demux: Fixed adaptive's handling of resolution settings.

  • Audio output: Fix audio distortion on macOS during start of playback.

  • Video Output: Direct3D11: Fix some potential crashes when using video filters.

  • Misc:

    • Several fixes in the web interface, including privacy and security improvements
    • Update YouTube and Vocaroo scripts.

  • Updated translations.

This update was imported from the openSUSE:Leap:15.2:Update update project.

Record
openSUSE-SU-2021:0714-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11502-1 No score

libvlc5-3.0.16-1.5 on GA media

These are all security issues fixed in the libvlc5-3.0.16-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11502-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vlc
Alpine:v3.12
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.13
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.14
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.15
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.16
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.17
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.18
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.19
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.20
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.21
 before 3.0.12-r0
3.0.12-r0
Show 18 moreShow less
Affected packages
PackageAffectedFixed
vlc
Alpine:v3.22
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.23
 before 3.0.12-r0
3.0.12-r0
vlc
Alpine:v3.24
 before 3.0.12-r0
3.0.12-r0
vlc
Debian:12
 before 3.0.12-1
3.0.12-1
vlc
Debian:13
 before 3.0.12-1
3.0.12-1
vlc
Debian:14
 before 3.0.12-1
3.0.12-1
vlc
Debian:9
 before 3.0.12-0+deb9u1, plus listed versions
2.2.6-12.2.6-1~deb9u12.2.6-22.2.6-32.2.6-4
Show 45 moreShow less
2.2.6-52.2.6-62.2.7-12.2.7-1~deb8u12.2.7-1~deb9u12.2.8-12.2.8-23.0.0-13.0.0~rc1-13.0.0~rc1~20171206-13.0.0~rc1~20171210-13.0.0~rc1~20171210-23.0.0~rc2-13.0.0~rc2-23.0.0~rc4-13.0.0~rc4-23.0.0~rc4-33.0.0~rc5-13.0.0~rc6-13.0.0~rc7-13.0.0~rc7-23.0.0~rc8-13.0.1-13.0.1-23.0.1-33.0.10-0+deb9u13.0.10-13.0.10-23.0.11-0+deb9u13.0.11-0+deb9u23.0.11-13.0.11-23.0.11-33.0.11-3~exp13.0.11-3~exp23.0.11-43.0.11.1-13.0.11.1-23.0.11.1-33.0.2-0+deb9u13.0.2-13.0.2-1+0.riscv64.13.0.2-1+0.riscv64.23.0.3-13.0.3-1+0.riscv64.1
3.0.12-0+deb9u1
vlc
Debian:10
 before 3.0.12-0+deb10u1, plus listed versions
3.0.10-0+deb10u13.0.10-13.0.10-23.0.11-0+deb10u13.0.11-1
Show 18 moreShow less
3.0.11-23.0.11-33.0.11-3~exp13.0.11-3~exp23.0.11-43.0.11.1-13.0.11.1-23.0.11.1-33.0.7-13.0.7.1-13.0.7.1-23.0.7.1-33.0.8-0+deb10u13.0.8-13.0.8-23.0.8-33.0.8-43.0.9.2-1
3.0.12-0+deb10u1
vlc
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3
Show 11 moreShow less
2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm12.2.2-5ubuntu0.16.04.5+esm22.2.2-5ubuntu0.16.04.5+esm32.2.2-5ubuntu0.16.04.5+esm4
 None known
vlc
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4
Show 23 moreShow less
2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.23.0.7.1-0ubuntu18.04.13.0.8-0ubuntu18.04.13.0.8-0ubuntu18.04.1+esm13.0.8-0ubuntu18.04.1+esm23.0.8-0ubuntu18.04.1+esm3
 None known
vlc
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.0.8-23.0.8-2build13.0.8-33.0.8-3build13.0.8-3build2
Show 6 moreShow less
3.0.8-3build43.0.8-43.0.9.2-13.0.9.2-1ubuntu0.1~esm13.0.9.2-1ubuntu0.1~esm23.0.9.2-1ubuntu0.1~esm3
 None known
vlc
openSUSE:Leap 15.1
 before 3.0.11.1-lp151.6.12.1
3.0.11.1-lp151.6.12.1
vlc
openSUSE:Leap 15.2
 before 3.0.11.1-lp152.2.9.1
3.0.11.1-lp152.2.9.1
vlc
SUSE:Package Hub 15 SP1
 before 3.0.11.1-bp151.5.12.1
3.0.11.1-bp151.5.12.1
vlc
SUSE:Package Hub 15 SP2
 before 3.0.11.1-bp152.2.9.1
3.0.11.1-bp152.2.9.1
vlc
openSUSE:Leap 15.2
 before 3.0.13-lp152.2.12.1
3.0.13-lp152.2.12.1
vlc
SUSE:Package Hub 15 SP2
 before 3.0.13-bp152.2.12.1
3.0.13-bp152.2.12.1
vlc
openSUSE:Tumbleweed
 before 3.0.16-1.5
3.0.16-1.5

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-26664 is a high vulnerability (CVSS 7.8) in Videolan Vlc Media Player, published January 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in vlc 3.0.12-r0.

References

Show 34 moreShow less
This page doesn't list everything

Left out here: 26 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open