CVE-2016-5108
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media...
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
- Record
CVE-2016-5108- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
- Record
CVE-2016-5108- Updated
- 2026-11-02
EUVDEUVD-2016-6059 No score
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
- Record
EUVD-2016-6059- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8h4-xfpc-5gq9
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media...
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
- Record
GHSA-w8h4-xfpc-5gq9- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
- Record
CVE-2016-5108- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-5108
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
- Record
DEBIAN-CVE-2016-5108- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-5108
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
- Record
UBUNTU-CVE-2016-5108- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0221 No score
Updated vlc/mad packages fix security vulnerability
A vulnerability was found in processing QuickTime IMA files. VLC does not check that the number of channels in the input stream is less than or equal to the size of the buffer, resulting in an out-of-bounds write potential for remote code execution via a malicious media file (CVE-2016-5108).
The vlc package has been updated to version 2.2.4, which fixes this issue and other bugs.
Also, the mad package has been patched to fix an out-of-bounds write which could cause VLC or other applications linked to that library to crash on an invalid mp3 file.
- Record
MGASA-2016-0221- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10064-1 No score
libvlc5-2.2.4-11.1 on GA media
These are all security issues fixed in the libvlc5-2.2.4-11.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10064-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 2.2.3-2 | 2.2.3-2 |
vlcDebian:13 |
before 2.2.3-2 | 2.2.3-2 |
vlcDebian:14 |
before 2.2.3-2 | 2.2.3-2 |
vlcDebian:8 |
before 2.2.4-1~deb8u1, plus listed versions 2.2.0-12.2.0~rc2-22.2.0~rc2-2+deb8u12.2.1-12.2.1-1~deb8u1 Show 12 moreShow less2.2.1-22.2.1-32.2.1-42.2.1-52.2.2-12.2.2-22.2.2-32.2.2-42.2.2-52.2.2-62.2.3-12.2.3-2 |
2.2.4-1~deb8u1 |
madMageia:5 |
before 0.15.1b-16.1.mga5 | 0.15.1b-16.1.mga5 |
vlcMageia:5 |
before 2.2.4-1.mga5 | 2.2.4-1.mga5 |
vlcMageia:5 |
before 2.2.4-1.mga5.tainted | 2.2.4-1.mga5.tainted |
vlcUbuntu:14.04:LTS |
before 2.1.6-0ubuntu14.04.3, plus listed versions 2.0.8-12.1.1-12.1.2-12.1.2-22.1.2-2build1 Show 4 moreShow less2.1.2-2build22.1.4-0ubuntu14.04.12.1.6-0ubuntu14.04.12.1.6-0ubuntu14.04.2 |
2.1.6-0ubuntu14.04.3 |
vlcUbuntu:16.04:LTS |
before 2.2.2-5ubuntu0.16.04.3, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 5 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.2 |
2.2.2-5ubuntu0.16.04.3 |
vlcopenSUSE:Tumbleweed |
before 2.2.4-11.1 | 2.2.4-11.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | VideoLAN VLC Media Player 2.2.1 - 'DecodeAdpcmImaQT' Buffer Overflow | 2016-05-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-5108 is a critical vulnerability (CVSS 9.8) in Videolan Vlc Media Player, published June 7, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.7%, the 97th percentile. Fixed in vlc 2.2.3-2.
References
lists.opensuse.org/opensuse-security-announce/2016-06/msg00045.html
securitytracker.com/id/1036009
debian.org/security/2016/dsa-3598
securityfocus.com/bid/90924
security.gentoo.org/glsa/201701-39
videolan.org/security/sa1601.html
Show 18 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-5108
github.com/advisories/GHSA-w8h4-xfpc-5gq9
security-tracker.debian.org/tracker/CVE-2016-5108
advisories.mageia.org/MGASA-2016-0221.html
bugs.mageia.org/show_bug.cgi?id=18567
openwall.com/lists/oss-security/2016/05/27/7
git.videolan.org?p=vlc/vlc-2.2.git;a=blob;f=NEWS;h=1af86bef0317c8882acc363a7c8fc5e83097c7bd;hb=888b7e89d78e7073075fc0a007d47b93f4570fab
ubuntu.com/security/CVE-2016-5108
cve.org/CVERecord?id=CVE-2016-5108
suse.com/security/cve/CVE-2010-2937