CVE-2024-46461
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer...
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
- Record
CVE-2024-46461- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2024-41844
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
- Record
EUVD-2024-41844- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hwv-fr9j-3wjq
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer...
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
- Record
GHSA-3hwv-fr9j-3wjq- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
- Record
CVE-2024-46461- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-46461
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
- Record
DEBIAN-CVE-2024-46461- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-46461
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
- Record
UBUNTU-CVE-2024-46461- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV No score
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
- Record
CVE-2024-46461- Updated
- 2026-11-02
OSVUSN-7243-1 No score
vlc vulnerability
It was discovered that VLC incorrectly handled memory when reading an MMS stream. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
- Record
USN-7243-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 3.0.21-0+deb12u1, plus listed versions 3.0.18-23.0.18-33.0.18-43.0.19-13.0.20-0+deb12u1 Show 4 moreShow less3.0.20-13.0.20-23.0.20-33.0.20-4 |
3.0.21-0+deb12u1 |
vlcDebian:13 |
before 3.0.21-1 | 3.0.21-1 |
vlcDebian:14 |
before 3.0.21-1 | 3.0.21-1 |
vlcDebian:11 |
before 3.0.21-0+deb11u1, plus listed versions 3.0.16-13.0.17-13.0.17.3-13.0.17.4-0+deb11u13.0.17.4-1 Show 16 moreShow less3.0.17.4-23.0.17.4-33.0.17.4-43.0.17.4-53.0.18-0+deb11u13.0.18-13.0.18-23.0.18-33.0.18-43.0.18~rc2-13.0.19-13.0.20-0+deb11u13.0.20-13.0.20-23.0.20-33.0.20-4 |
3.0.21-0+deb11u1 |
vlcUbuntu:Pro:16.04:LTS |
before 2.2.2-5ubuntu0.16.04.5+esm4, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 10 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm12.2.2-5ubuntu0.16.04.5+esm22.2.2-5ubuntu0.16.04.5+esm3 |
2.2.2-5ubuntu0.16.04.5+esm4 |
vlcUbuntu:Pro:18.04:LTS |
before 3.0.8-0ubuntu18.04.1+esm3, plus listed versions 2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4 Show 22 moreShow less2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.23.0.7.1-0ubuntu18.04.13.0.8-0ubuntu18.04.13.0.8-0ubuntu18.04.1+esm13.0.8-0ubuntu18.04.1+esm2 |
3.0.8-0ubuntu18.04.1+esm3 |
vlcUbuntu:Pro:20.04:LTS |
before 3.0.9.2-1ubuntu0.1~esm3, plus listed versions 3.0.8-23.0.8-2build13.0.8-33.0.8-3build13.0.8-3build2 Show 5 moreShow less3.0.8-3build43.0.8-43.0.9.2-13.0.9.2-1ubuntu0.1~esm13.0.9.2-1ubuntu0.1~esm2 |
3.0.9.2-1ubuntu0.1~esm3 |
vlcUbuntu:22.04:LTS |
All versions, plus listed versions 3.0.16-13.0.16-1build13.0.16-1build23.0.16-1build33.0.16-1build43.0.16-1build53.0.16-1build7 |
None known |
vlcUbuntu:Pro:22.04:LTS |
before 3.0.16-1ubuntu0.1~esm3, plus listed versions 3.0.16-13.0.16-1build13.0.16-1build23.0.16-1build33.0.16-1build4 Show 4 moreShow less3.0.16-1build53.0.16-1build73.0.16-1ubuntu0.1~esm13.0.16-1ubuntu0.1~esm2 |
3.0.16-1ubuntu0.1~esm3 |
vlcUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.18-43.0.19-13.0.19-1build13.0.20-1build13.0.20-3build6 |
None known |
vlcUbuntu:Pro:24.04:LTS |
before 3.0.20-3ubuntu0.1~esm1, plus listed versions 3.0.18-43.0.19-13.0.19-1build13.0.20-1build13.0.20-3build6 |
3.0.20-3ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-46461 is a high vulnerability (CVSS 8.0) in Videolan Vlc Media Player, published June 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile. Fixed in vlc 3.0.21-0+deb12u1.