{"id":"CVE-2016-5108","aliases":["DEBIAN-CVE-2016-5108","DSA-3598-1","EUVD-2016-6059","GHSA-w8h4-xfpc-5gq9","MGASA-2016-0221","UBUNTU-CVE-2016-5108","openSUSE-SU-2024:10064-1"],"status":"published","title":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media...","description":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.24748,"percentile":0.97913,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2016-06-07T00:00:00Z","modified":"2026-09-22T07:00:25Z","exploits":[{"source":"exploitdb","id":"EDB-41025","title":"VideoLAN VLC Media Player 2.2.1 - 'DecodeAdpcmImaQT' Buffer Overflow","type":"dos","platform":"windows","date":"2016-05-27","verified":true,"url":"https://www.exploit-db.com/exploits/41025"}],"fixes":[{"ecosystem":"Debian:12","package":"vlc","fixed_in":["2.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["2.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["2.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"vlc","fixed_in":["2.2.4-1~deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"mad","fixed_in":["0.15.1b-16.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"vlc","fixed_in":["2.2.4-1.mga5","2.2.4-1.mga5.tainted"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"vlc","fixed_in":["2.1.6-0ubuntu14.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"vlc","fixed_in":["2.2.2-5ubuntu0.16.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1~deb8u1"}]}],"versions":["2.2.0-1","2.2.0~rc2-2","2.2.0~rc2-2+deb8u1","2.2.1-1","2.2.1-1~deb8u1","2.2.1-2","2.2.1-3","2.2.1-4","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-4","2.2.2-5","2.2.2-6","2.2.3-1","2.2.3-2"]},{"source":"osv","ecosystem":"Mageia:5","package":"mad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-16.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1.mga5.tainted"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.6-0ubuntu14.04.3"}]}],"versions":["2.0.8-1","2.1.1-1","2.1.2-1","2.1.2-2","2.1.2-2build1","2.1.2-2build2","2.1.4-0ubuntu14.04.1","2.1.6-0ubuntu14.04.1","2.1.6-0ubuntu14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5ubuntu0.16.04.3"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-11.1"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"videolan","product":"vlc_media_player"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00045.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1036009","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3598","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/90924","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-39","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.videolan.org/security/sa1601.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5108"},{"url":"https://github.com/advisories/GHSA-w8h4-xfpc-5gq9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5108","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0221.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18567","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/27/7","tags":["web"]},{"url":"http://git.videolan.org/?p=vlc/vlc-2.2.git;a=blob;f=NEWS;h=1af86bef0317c8882acc363a7c8fc5e83097c7bd;hb=888b7e89d78e7073075fc0a007d47b93f4570fab","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-5108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5108","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5108","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-5108","description":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.","status":"published","published":"2016-06-08T14:00:00Z","modified":"2024-08-06T00:53:47.384Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2016-6059","description":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.","status":"published","published":"2016-06-08T14:00:00Z","modified":"2024-08-06T00:53:47Z","updated_at":"2026-11-03T02:22:43.959327Z"}],"ghsa":[{"id":"GHSA-w8h4-xfpc-5gq9","title":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media...","description":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.","status":"published","published":"2022-05-17T02:37:30Z","modified":"2023-01-27T05:05:52Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:42:47.147954Z"}],"nvd":[{"id":"CVE-2016-5108","description":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.","status":"published","published":"2016-06-08T15:00:04.113Z","modified":"2026-06-17T00:48:46.6Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-5108","description":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.","status":"published","published":"2016-06-08T15:00:04.113Z","modified":"2026-04-16T06:17:47.370495912Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-5108","description":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.","status":"published","published":"2016-06-08T15:00:04.113Z","modified":"2026-09-22T07:00:25.646550188Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-5108","description":"Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.","status":"published","published":"2016-06-08T15:00:00Z","modified":"2026-04-22T10:47:53.649556Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DSA-3598-1","title":"vlc - security update","status":"published","published":"2016-06-07T00:00:00Z","modified":"2026-03-09T01:21:48.606944Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0221","title":"Updated vlc/mad packages fix security vulnerability","description":"A vulnerability was found in processing QuickTime IMA files. VLC does not\ncheck that the number of channels in the input stream is less than or\nequal to the size of the buffer, resulting in an out-of-bounds write\npotential for remote code execution via a malicious media file\n(CVE-2016-5108).\n\nThe vlc package has been updated to version 2.2.4, which fixes this issue\nand other bugs.\n\nAlso, the mad package has been patched to fix an out-of-bounds write which\ncould cause VLC or other applications linked to that library to crash on\nan invalid mp3 file.\n","status":"published","published":"2016-06-10T19:06:07Z","modified":"2026-04-16T06:23:10.661025484Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10064-1","title":"libvlc5-2.2.4-11.1 on GA media","description":"These are all security issues fixed in the libvlc5-2.2.4-11.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:30:57.121466Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}