CVE-2023-47360
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect...
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
- Record
CVE-2023-47360- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
CVE List
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
- Record
CVE-2023-47360- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
EUVDEUVD-2023-51477
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
- Record
EUVD-2023-51477- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xpr9-hg8g-rgg6
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect...
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
- Record
GHSA-xpr9-hg8g-rgg6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
OSV
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
- Record
CVE-2023-47360- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-47360
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
- Record
DEBIAN-CVE-2023-47360- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-47360
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
- Record
UBUNTU-CVE-2023-47360- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2024-0007 No score
Updated vlc packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption (CVE-2023-47359). Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length (CVE-2023-47360).
- Record
MGASA-2024-0007- Updated
- 2026-11-02
OSVUSN-6783-1 No score
vlc vulnerabilities
It was discovered that VLC incorrectly handled certain media files. A remote attacker could possibly use this issue to cause VLC to crash, resulting in a denial of service, or potential arbitrary code execution.
- Record
USN-6783-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 3.0.20-0+deb12u1, plus listed versions 3.0.18-23.0.18-33.0.18-43.0.19-1 |
3.0.20-0+deb12u1 |
vlcDebian:13 |
before 3.0.20-1 | 3.0.20-1 |
vlcDebian:14 |
before 3.0.20-1 | 3.0.20-1 |
vlcDebian:10 From an advisory covering 2 CVEs |
before 3.0.20-0+deb10u1, plus listed versions 3.0.10-0+deb10u13.0.10-13.0.10-23.0.11-0+deb10u13.0.11-1 Show 39 moreShow less3.0.11-23.0.11-33.0.11-3~exp13.0.11-3~exp23.0.11-43.0.11.1-13.0.11.1-23.0.11.1-33.0.12-0+deb10u13.0.12-13.0.12-23.0.12-33.0.15-13.0.16-13.0.17-13.0.17.3-13.0.17.4-0+deb10u13.0.17.4-0+deb10u23.0.17.4-13.0.17.4-23.0.17.4-33.0.17.4-43.0.17.4-53.0.18-13.0.18-23.0.18-33.0.18-43.0.18~rc2-13.0.19-13.0.7-13.0.7.1-13.0.7.1-23.0.7.1-33.0.8-0+deb10u13.0.8-13.0.8-23.0.8-33.0.8-43.0.9.2-1 |
3.0.20-0+deb10u1 |
vlcDebian:11 From an advisory covering 2 CVEs |
before 3.0.20-0+deb11u1, plus listed versions 3.0.16-13.0.17-13.0.17.3-13.0.17.4-0+deb11u13.0.17.4-1 Show 11 moreShow less3.0.17.4-23.0.17.4-33.0.17.4-43.0.17.4-53.0.18-0+deb11u13.0.18-13.0.18-23.0.18-33.0.18-43.0.18~rc2-13.0.19-1 |
3.0.20-0+deb11u1 |
vlcDebian:12 From an advisory covering 2 CVEs |
before 3.0.20-0+deb12u1, plus listed versions 3.0.18-23.0.18-33.0.18-43.0.19-1 |
3.0.20-0+deb12u1 |
vlcMageia:9 From an advisory covering 2 CVEs |
before 3.0.20-1.mga9 | 3.0.20-1.mga9 |
vlcMageia:9 From an advisory covering 2 CVEs |
before 3.0.20-1.mga9.tainted | 3.0.20-1.mga9.tainted |
vlcUbuntu:Pro:16.04:LTS |
before 2.2.2-5ubuntu0.16.04.5+esm3, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 9 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm12.2.2-5ubuntu0.16.04.5+esm2 |
2.2.2-5ubuntu0.16.04.5+esm3 |
vlcUbuntu:Pro:18.04:LTS |
before 3.0.8-0ubuntu18.04.1+esm2, plus listed versions 2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4 Show 21 moreShow less2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.23.0.7.1-0ubuntu18.04.13.0.8-0ubuntu18.04.13.0.8-0ubuntu18.04.1+esm1 |
3.0.8-0ubuntu18.04.1+esm2 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
vlcUbuntu:Pro:20.04:LTS |
before 3.0.9.2-1ubuntu0.1~esm2, plus listed versions 3.0.8-23.0.8-2build13.0.8-33.0.8-3build13.0.8-3build2 Show 4 moreShow less3.0.8-3build43.0.8-43.0.9.2-13.0.9.2-1ubuntu0.1~esm1 |
3.0.9.2-1ubuntu0.1~esm2 |
vlcUbuntu:Pro:22.04:LTS |
before 3.0.16-1ubuntu0.1~esm2, plus listed versions 3.0.16-13.0.16-1build13.0.16-1build23.0.16-1build33.0.16-1build43.0.16-1build53.0.16-1build73.0.16-1ubuntu0.1~esm1 |
3.0.16-1ubuntu0.1~esm2 |
vlcUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 2.2.2-5ubuntu0.16.04.5+esm3, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 9 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm12.2.2-5ubuntu0.16.04.5+esm2 |
2.2.2-5ubuntu0.16.04.5+esm3 |
vlcUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 3.0.8-0ubuntu18.04.1+esm2, plus listed versions 2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4 Show 21 moreShow less2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.23.0.7.1-0ubuntu18.04.13.0.8-0ubuntu18.04.13.0.8-0ubuntu18.04.1+esm1 |
3.0.8-0ubuntu18.04.1+esm2 |
vlcUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 3.0.9.2-1ubuntu0.1~esm2, plus listed versions 3.0.8-23.0.8-2build13.0.8-33.0.8-3build13.0.8-3build2 Show 4 moreShow less3.0.8-3build43.0.8-43.0.9.2-13.0.9.2-1ubuntu0.1~esm1 |
3.0.9.2-1ubuntu0.1~esm2 |
vlcUbuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 3.0.16-1ubuntu0.1~esm2, plus listed versions 3.0.16-13.0.16-1build13.0.16-1build23.0.16-1build33.0.16-1build43.0.16-1build53.0.16-1build73.0.16-1ubuntu0.1~esm1 |
3.0.16-1ubuntu0.1~esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-47360 is a high vulnerability (CVSS 7.5) in Videolan Vlc Media Player, published November 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in vlc 3.0.20-0+deb12u1.