CVE-2017-8311
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping...
CVE-2017-8311 is a high vulnerability (CVSS 7.8) in Videolan Vlc, published May 23, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.77%, the 95th percentile. Fixed in vlc 2.2.5-1.
- Severity
- 7.8 HighCVSS 3.0, NVD
- Exploit chance
- 8.77%EPSS, 95th percentile
- Exploitation
- None known1 public exploit
- Fixed in
2.2.5-1vlc +5 more
Description
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 | before 2.2.5-1 | 2.2.5-1 |
vlcDebian:13 | before 2.2.5-1 | 2.2.5-1 |
vlcDebian:14 | before 2.2.5-1 | 2.2.5-1 |
vlcDebian:8 From an advisory covering 4 CVEs | before 2.2.6-1~deb8u1, plus listed versions 2.2.0-12.2.0~rc2-22.2.0~rc2-2+deb8u12.2.1-12.2.1-1~deb8u1 Show 35 moreShow less2.2.1-22.2.1-32.2.1-42.2.1-52.2.2-12.2.2-22.2.2-32.2.2-42.2.2-52.2.2-62.2.3-12.2.3-22.2.4-12.2.4-102.2.4-112.2.4-122.2.4-132.2.4-142.2.4-1~deb8u12.2.4-22.2.4-32.2.4-42.2.4-52.2.4-62.2.4-72.2.4-82.2.4-92.2.5-12.2.5-1~deb8u12.2.5-22.2.5-32.2.5-42.2.5.1-12.2.5.1-1~deb9u12.2.5.1-1~deb9u2 | 2.2.6-1~deb8u1 |
vlcUbuntu:14.04:LTS | before 2.1.6-0ubuntu14.04.3, plus listed versions 2.0.8-12.1.1-12.1.2-12.1.2-22.1.2-2build1 Show 4 moreShow less2.1.2-2build22.1.4-0ubuntu14.04.12.1.6-0ubuntu14.04.12.1.6-0ubuntu14.04.2 | 2.1.6-0ubuntu14.04.3 |
vlcUbuntu:16.04:LTS | before 2.2.2-5ubuntu0.16.04.3, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 5 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.2 | 2.2.2-5ubuntu0.16.04.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | VLC Media Player/Kodi/PopcornTime 'Red Chimera' < 2.2.5 - Memory Corruption (PoC) | 2018-04-24 |
What each source reports
NVD Score used
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
CVE-2017-8311- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
CVE-2017-8311- Updated
- 2026-11-02
EUVDEUVD-2017-17272No score
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
EUVD-2017-17272- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3gx-7f25-5jxg
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping...
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
GHSA-h3gx-7f25-5jxg- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
CVE-2017-8311- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-8311
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
DEBIAN-CVE-2017-8311- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-8311
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
- Record
UBUNTU-CVE-2017-8311- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.