CVE-2025-51602
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of...
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
- Record
CVE-2025-51602- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-2904
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
- Record
EUVD-2026-2904- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5fj6-q8x2-56g8
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of...
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
- Record
GHSA-5fj6-q8x2-56g8- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
- Record
CVE-2025-51602- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-51602
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
- Record
DEBIAN-CVE-2025-51602- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-51602
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
- Record
UBUNTU-CVE-2025-51602- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 3.0.22-0+deb12u1, plus listed versions 3.0.18-23.0.18-33.0.18-43.0.19-13.0.20-0+deb12u1 Show 19 moreShow less3.0.20-13.0.20-23.0.20-33.0.20-43.0.21-0+deb12u13.0.21-13.0.21-103.0.21-113.0.21-23.0.21-33.0.21-43.0.21-4~exp13.0.21-53.0.21-63.0.21-73.0.21-83.0.21-93.0.22~rc1-13.0.22~rc2-1 |
3.0.22-0+deb12u1 |
vlcDebian:13 |
before 3.0.22-0+deb13u1, plus listed versions 3.0.21-103.0.21-113.0.22~rc1-13.0.22~rc2-1 |
3.0.22-0+deb13u1 |
vlcDebian:14 |
before 3.0.22-1, plus listed versions 3.0.21-103.0.21-113.0.22~rc1-13.0.22~rc2-1 |
3.0.22-1 |
vlcDebian:11 |
before 3.0.23-0+deb11u1, plus listed versions 3.0.16-13.0.17-13.0.17.3-13.0.17.4-0+deb11u13.0.17.4-1 Show 35 moreShow less3.0.17.4-23.0.17.4-33.0.17.4-43.0.17.4-53.0.18-0+deb11u13.0.18-13.0.18-23.0.18-33.0.18-43.0.18~rc2-13.0.19-13.0.20-0+deb11u13.0.20-13.0.20-23.0.20-33.0.20-43.0.21-0+deb11u13.0.21-13.0.21-103.0.21-113.0.21-23.0.21-33.0.21-43.0.21-4~exp13.0.21-53.0.21-63.0.21-73.0.21-83.0.21-93.0.22-13.0.22-23.0.22-33.0.22-43.0.22~rc1-13.0.22~rc2-1 |
3.0.23-0+deb11u1 |
vlcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 11 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm12.2.2-5ubuntu0.16.04.5+esm22.2.2-5ubuntu0.16.04.5+esm32.2.2-5ubuntu0.16.04.5+esm4 |
None known |
vlcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4 Show 23 moreShow less2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.23.0.7.1-0ubuntu18.04.13.0.8-0ubuntu18.04.13.0.8-0ubuntu18.04.1+esm13.0.8-0ubuntu18.04.1+esm23.0.8-0ubuntu18.04.1+esm3 |
None known |
vlcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.8-23.0.8-2build13.0.8-33.0.8-3build13.0.8-3build2 Show 6 moreShow less3.0.8-3build43.0.8-43.0.9.2-13.0.9.2-1ubuntu0.1~esm13.0.9.2-1ubuntu0.1~esm23.0.9.2-1ubuntu0.1~esm3 |
None known |
vlcUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.0.16-13.0.16-1build13.0.16-1build23.0.16-1build33.0.16-1build4 Show 5 moreShow less3.0.16-1build53.0.16-1build73.0.16-1ubuntu0.1~esm13.0.16-1ubuntu0.1~esm23.0.16-1ubuntu0.1~esm3 |
None known |
vlcUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.0.18-43.0.19-13.0.19-1build13.0.20-1build13.0.20-3build63.0.20-3ubuntu0.1~esm1 |
None known |
vlcUbuntu:25.10 |
All versions, plus listed versions 3.0.21-9build13.0.21-103.0.21-10build13.0.21-11 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-51602 is a medium vulnerability (CVSS 4.8) in Videolan Vlc Media Player, published December 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in vlc 3.0.22-0+deb12u1.
References
videolan.org/security/sb-vlc3022.html
code.videolan.org/videolan/vlc/-/issues/29146
lists.debian.org/debian-lts-announce/2026/03/msg00011.html
nvd.nist.gov/vuln/detail/CVE-2025-51602
github.com/advisories/GHSA-5fj6-q8x2-56g8
security-tracker.debian.org/tracker/CVE-2025-51602
ubuntu.com/security/CVE-2025-51602
cve.org/CVERecord?id=CVE-2025-51602