{"id":"CVE-2020-13428","aliases":["ALPINE-CVE-2020-13428","DEBIAN-CVE-2020-13428","DSA-4704-1","EUVD-2020-5682","GHSA-2cf7-9933-4jgc","MGASA-2020-0272","UBUNTU-CVE-2020-13428","USN-6180-1","openSUSE-SU-2021:0076-1","openSUSE-SU-2021:0091-1","openSUSE-SU-2021:0121-1","openSUSE-SU-2021:0122-1","openSUSE-SU-2024:11502-1"],"status":"published","title":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c...","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02462,"percentile":0.84573,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2020-06-08T18:13:04Z","modified":"2026-11-03T06:32:30Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vlc","fixed_in":["3.0.11-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"vlc","fixed_in":["3.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["3.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["3.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"vlc","fixed_in":["3.0.11-0+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"vlc","fixed_in":["3.0.11-0+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"vlc","fixed_in":["3.0.11-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","fixed_in":["3.0.8-0ubuntu18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","fixed_in":["3.0.9.2-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-0+deb9u1"}]}],"versions":["2.2.6-1","2.2.6-1~deb9u1","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.6-6","2.2.7-1","2.2.7-1~deb8u1","2.2.7-1~deb9u1","2.2.8-1","2.2.8-2","3.0.0-1","3.0.0~rc1-1","3.0.0~rc1~20171206-1","3.0.0~rc1~20171210-1","3.0.0~rc1~20171210-2","3.0.0~rc2-1","3.0.0~rc2-2","3.0.0~rc4-1","3.0.0~rc4-2","3.0.0~rc4-3","3.0.0~rc5-1","3.0.0~rc6-1","3.0.0~rc7-1","3.0.0~rc7-2","3.0.0~rc8-1","3.0.1-1","3.0.1-2","3.0.1-3","3.0.10-0+deb9u1","3.0.10-1","3.0.10-2","3.0.2-0+deb9u1","3.0.2-1","3.0.2-1+0.riscv64.1","3.0.2-1+0.riscv64.2","3.0.3-1","3.0.3-1+0.riscv64.1","3.0.3-1+b1+0.riscv64.1","3.0.3-1-0+deb9u1","3.0.3-1-1","3.0.3-1-2","3.0.3-1-3","3.0.3-1-4","3.0.3-2","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.5-1","3.0.5-2","3.0.6-0+deb9u1","3.0.6-1","3.0.7-0+deb9u1","3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb9u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"]},{"source":"osv","ecosystem":"Debian:10","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-0+deb10u1"}]}],"versions":["3.0.10-0+deb10u1","3.0.10-1","3.0.10-2","3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb10u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"]},{"source":"osv","ecosystem":"Mageia:7","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1ubuntu0.1~esm1"}]}],"versions":["3.0.8-2","3.0.8-2build1","3.0.8-3","3.0.8-3build1","3.0.8-3build2","3.0.8-3build4","3.0.8-4","3.0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5ubuntu0.16.04.5+esm2"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2","2.2.2-5ubuntu0.16.04.3","2.2.2-5ubuntu0.16.04.4","2.2.2-5ubuntu0.16.04.5+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1ubuntu0.1~esm1"}]}],"versions":["3.0.8-2","3.0.8-2build1","3.0.8-3","3.0.8-3build1","3.0.8-3build2","3.0.8-3build4","3.0.8-4","3.0.9.2-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-1ubuntu0.1~esm1"}]}],"versions":["3.0.16-1","3.0.16-1build1","3.0.16-1build2","3.0.16-1build3","3.0.16-1build4","3.0.16-1build5","3.0.16-1build7"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11.1-lp151.6.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11.1-lp152.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11.1-bp151.5.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11.1-bp152.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-1.5"}]}],"bundled":17}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"videolan","product":"vlc_media_player"}],"references":[{"url":"https://github.com/videolan/vlc/commits/master/modules/packetizer/hxxx_nal.c","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=d5c43c21c747ff30ed19fcca745dea3481c733e0","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/videolan/vlc-3.0/releases/tag/3.0.11","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2020/dsa-4704","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.videolan.org/security/sb-vlc3011.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13428"},{"url":"http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=d5c43c21c747ff30ed19fcca745dea3481c733e0","tags":["report"]},{"url":"https://github.com/advisories/GHSA-2cf7-9933-4jgc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-13428","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13428","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0272.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26809","tags":["report"]},{"url":"https://git.videolan.org/?p=vlc/vlc-3.0.git;a=blob;f=NEWS;h=5a61ba26cec611bbc045fb235d40eba9e0a88ccf;hb=dc0c5ced7230e5660142302c7c1aef6cc14f3564","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-13428","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6180-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41325","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OD6C4CTIQTZF237437FPGD5AIRV33TET/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133290","tags":["report"]},{"url":"https://bugzilla.suse.com/1172727","tags":["report"]},{"url":"https://bugzilla.suse.com/1180755","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26664","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KIZQCEFFNAB3CPF433JKRUT3ZM2EDM33/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IYGQU4F6PPW4XHK4LTESKSQ2CPHZS3QW/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YJCT5WYFJXXNRF5NSC7LOIHN7BD5UKVV/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5460","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-13428","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","status":"published","published":"2020-06-08T18:13:04Z","modified":"2024-08-04T12:18:18.469Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-5682","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","status":"published","published":"2020-06-08T18:13:04Z","modified":"2024-08-04T12:18:18Z","updated_at":"2026-11-03T03:07:37.76906Z"}],"ghsa":[{"id":"GHSA-2cf7-9933-4jgc","title":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c...","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player through 3.2.8 for iOS, and through 3.0.10 for macOS, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","status":"published","published":"2022-05-24T17:19:33Z","modified":"2023-03-03T03:30:24Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:15.627441Z"}],"nvd":[{"id":"CVE-2020-13428","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","status":"published","published":"2020-06-08T19:15:10.58Z","modified":"2026-06-17T02:53:07.65Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"ALPINE-CVE-2020-13428","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","status":"published","published":"2020-06-08T19:15:10.58Z","modified":"2026-11-03T06:32:30.843635559Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2020-13428","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","status":"published","published":"2020-06-08T19:15:10.58Z","modified":"2026-10-20T10:51:13.808790637Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-13428","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","status":"published","published":"2020-06-08T19:15:10.58Z","modified":"2026-10-26T12:02:25.554634833Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-13428","description":"A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.","status":"published","published":"2020-06-08T19:15:00Z","modified":"2026-04-22T12:28:35.191763Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DSA-4704-1","title":"vlc - security update","status":"published","published":"2020-06-16T00:00:00Z","modified":"2026-03-09T02:10:23.643662Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0272","title":"Updated vlc packages fix security vulnerability","description":"Updated vlc packages fixes security vulnerability:\n\nA heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in\nmodules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11\nallows remote attackers to cause a denial of service (application crash)\nor execute arbitrary code via a crafted H.264 Annex-B video (.avi for\nexample) file (CVE-2020-13428).\n\nThe vlc package has been updated to version 3.0.11, fixing this issue and\nother bugs.\n","status":"published","published":"2020-07-04T22:47:21Z","modified":"2026-04-16T04:43:12.915466336Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2021:0076-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\nUpdate to 3.0.11.1:\n    \n- CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727)\n- CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755)\n","status":"published","published":"2021-01-16T10:06:30Z","modified":"2026-02-04T03:14:29.566639Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0091-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\nUpdate to 3.0.11.1:\n    \n- CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727)\n- CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755)\n","status":"published","published":"2021-01-16T18:54:28Z","modified":"2026-02-04T03:04:36.694887Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0121-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\nUpdate to 3.0.11.1:\n    \n- CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727)\n- CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755)\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2021-01-19T17:24:42Z","modified":"2026-02-04T02:16:35.082601Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0122-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\nUpdate to 3.0.11.1:\n    \n- CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727)\n- CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755)\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-01-19T23:23:58Z","modified":"2026-02-04T03:42:07.056982Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11502-1","title":"libvlc5-3.0.16-1.5 on GA media","description":"These are all security issues fixed in the libvlc5-3.0.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:48:02.043281Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-6180-1","title":"vlc vulnerabilities","description":"It was discovered that VLC could be made to read out of bounds when\ndecoding image files. If a user were tricked into opening a crafted image\nfile, a remote attacker could possibly use this issue to cause VLC to\ncrash, leading to a denial of service. This issue only affected Ubuntu\n16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-19721)\n\nIt was discovered that VLC could be made to write out of bounds when\nprocessing H.264 video files. If a user were tricked into opening a\ncrafted H.264 video file, a remote attacker could possibly use this issue\nto cause VLC to crash, leading to a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS and \nUbuntu 20.04 LTS. (CVE-2020-13428)\n\nIt was discovered that VLC could be made to read out of bounds when\nprocessing AVI video files. If a user were tricked into opening a crafted\nAVI video file, a remote attacker could possibly use this issue to cause\nVLC to crash, leading to a denial of service. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-25801,\nCVE-2021-25802, CVE-2021-25803, CVE-2021-25804)\n\nIt was discovered that the VNC module of VLC contained an arithmetic\noverflow. If a user were tricked into opening a crafted playlist or\nconnecting to a rouge VNC server, a remote attacker could possibly use\nthis issue to cause VLC to crash, leading to a denial of service, or\npossibly execute arbitrary code. (CVE-2022-41325)\n","status":"published","published":"2023-06-20T19:47:23Z","modified":"2026-06-25T13:32:09.557035499Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}