{"id":"CVE-2021-25801","aliases":["DEBIAN-CVE-2021-25801","DLA-2728-1","DSA-4834-1","EUVD-2021-12684","GHSA-vwcj-ffx4-g5rx","UBUNTU-CVE-2021-25801","USN-6180-1"],"status":"published","title":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11...","description":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01522,"percentile":0.74977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-120","CWE-125"],"published":"2021-01-22T00:00:00Z","modified":"2026-10-24T10:30:46Z","exploits":[{"source":"pocgithub","id":"DShankle/VLC_CVE-2021-25801_Analysis","title":"DShankle/VLC_CVE-2021-25801_Analysis","date":"2022-04-21","url":"https://github.com/DShankle/VLC_CVE-2021-25801_Analysis"}],"fixes":[{"ecosystem":"Debian:12","package":"vlc","fixed_in":["3.0.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["3.0.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["3.0.12-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","fixed_in":["2.2.2-5ubuntu0.16.04.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","fixed_in":["3.0.8-0ubuntu18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","fixed_in":["3.0.9.2-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-0+deb9u2"}]}],"versions":["2.2.6-1","2.2.6-1~deb9u1","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.6-6","2.2.7-1","2.2.7-1~deb8u1","2.2.7-1~deb9u1","2.2.8-1","2.2.8-2","3.0.0-1","3.0.0~rc1-1","3.0.0~rc1~20171206-1","3.0.0~rc1~20171210-1","3.0.0~rc1~20171210-2","3.0.0~rc2-1","3.0.0~rc2-2","3.0.0~rc4-1","3.0.0~rc4-2","3.0.0~rc4-3","3.0.0~rc5-1","3.0.0~rc6-1","3.0.0~rc7-1","3.0.0~rc7-2","3.0.0~rc8-1","3.0.1-1","3.0.1-2","3.0.1-3","3.0.10-0+deb9u1","3.0.10-1","3.0.10-2","3.0.11-0+deb9u1","3.0.2-0+deb9u1","3.0.2-1","3.0.2-1+0.riscv64.1","3.0.2-1+0.riscv64.2","3.0.3-1","3.0.3-1+0.riscv64.1","3.0.3-1+b1+0.riscv64.1","3.0.3-1-0+deb9u1","3.0.3-1-1","3.0.3-1-2","3.0.3-1-3","3.0.3-1-4","3.0.3-2","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.5-1","3.0.5-2","3.0.6-0+deb9u1","3.0.6-1","3.0.7-0+deb9u1","3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb9u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-0+deb10u1"}]}],"versions":["3.0.10-0+deb10u1","3.0.10-1","3.0.10-2","3.0.11-0+deb10u1","3.0.11-1","3.0.11-2","3.0.11-3","3.0.11-3~exp1","3.0.11-3~exp2","3.0.11-4","3.0.11.1-1","3.0.11.1-2","3.0.11.1-3","3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb10u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5ubuntu0.16.04.5+esm2"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2","2.2.2-5ubuntu0.16.04.3","2.2.2-5ubuntu0.16.04.4","2.2.2-5ubuntu0.16.04.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1ubuntu0.1~esm1"}]}],"versions":["3.0.8-2","3.0.8-2build1","3.0.8-3","3.0.8-3build1","3.0.8-3build2","3.0.8-3build4","3.0.8-4","3.0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5ubuntu0.16.04.5+esm2"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2","2.2.2-5ubuntu0.16.04.3","2.2.2-5ubuntu0.16.04.4","2.2.2-5ubuntu0.16.04.5+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1ubuntu0.1~esm1"}]}],"versions":["3.0.8-2","3.0.8-2build1","3.0.8-3","3.0.8-3build1","3.0.8-3build2","3.0.8-3build4","3.0.8-4","3.0.9.2-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-1ubuntu0.1~esm1"}]}],"versions":["3.0.16-1","3.0.16-1build1","3.0.16-1build2","3.0.16-1build3","3.0.16-1build4","3.0.16-1build5","3.0.16-1build7"],"bundled":7}],"products":[{"vendor":"videolan","product":"vlc_media_player"}],"references":[{"url":"https://code.videolan.org/videolan/vlc-3.0/-/commit/f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25801"},{"url":"https://github.com/advisories/GHSA-vwcj-ffx4-g5rx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-25801","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-25801","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6180-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-25801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41325","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-25801","description":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.","status":"published","published":"2021-07-26T16:26:55Z","modified":"2024-08-03T20:11:28.44Z","updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2021-12684","description":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.","status":"published","published":"2021-07-26T16:26:55Z","modified":"2024-08-03T20:11:28Z","updated_at":"2026-11-03T03:24:52.420769Z"}],"ghsa":[{"id":"GHSA-vwcj-ffx4-g5rx","title":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11...","description":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.","status":"published","published":"2022-05-24T19:09:12Z","modified":"2023-01-30T05:00:58Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-120","CWE-125"],"updated_at":"2026-11-02T14:46:18.635114Z"}],"nvd":[{"id":"CVE-2021-25801","description":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.","status":"published","published":"2021-07-26T17:15:07.777Z","modified":"2026-06-17T03:42:27.697Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"CVE-2021-25801","description":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.","status":"published","published":"2021-07-26T17:15:07.777Z","modified":"2026-10-24T10:30:46.694308989Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-25801","description":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.","status":"published","published":"2021-07-26T17:15:07.777Z","modified":"2026-10-23T18:02:57.638768111Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-25801","description":"A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.","status":"published","published":"2021-07-26T17:15:00Z","modified":"2026-04-22T12:49:53.004889Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2728-1","title":"vlc - security update","status":"published","published":"2021-08-03T00:00:00Z","modified":"2026-03-09T01:19:15.657874Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4834-1","title":"vlc - security update","status":"published","published":"2021-01-22T00:00:00Z","modified":"2026-03-09T02:08:28.994944Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-6180-1","title":"vlc vulnerabilities","description":"It was discovered that VLC could be made to read out of bounds when\ndecoding image files. If a user were tricked into opening a crafted image\nfile, a remote attacker could possibly use this issue to cause VLC to\ncrash, leading to a denial of service. This issue only affected Ubuntu\n16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-19721)\n\nIt was discovered that VLC could be made to write out of bounds when\nprocessing H.264 video files. If a user were tricked into opening a\ncrafted H.264 video file, a remote attacker could possibly use this issue\nto cause VLC to crash, leading to a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS and \nUbuntu 20.04 LTS. (CVE-2020-13428)\n\nIt was discovered that VLC could be made to read out of bounds when\nprocessing AVI video files. If a user were tricked into opening a crafted\nAVI video file, a remote attacker could possibly use this issue to cause\nVLC to crash, leading to a denial of service. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-25801,\nCVE-2021-25802, CVE-2021-25803, CVE-2021-25804)\n\nIt was discovered that the VNC module of VLC contained an arithmetic\noverflow. If a user were tricked into opening a crafted playlist or\nconnecting to a rouge VNC server, a remote attacker could possibly use\nthis issue to cause VLC to crash, leading to a denial of service, or\npossibly execute arbitrary code. (CVE-2022-41325)\n","status":"published","published":"2023-06-20T19:47:23Z","modified":"2026-06-25T13:32:09.557035499Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}