{"id":"CVE-2022-41325","aliases":["ALPINE-CVE-2022-41325","DEBIAN-CVE-2022-41325","DLA-3216-1","DSA-5297-1","EUVD-2022-44532","GHSA-xxf6-mj48-xcg3","UBUNTU-CVE-2022-41325","USN-6180-1","openSUSE-SU-2022:10252-1","openSUSE-SU-2022:10255-1","openSUSE-SU-2023:0366-1","openSUSE-SU-2024:12582-1"],"status":"published","title":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows...","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00683,"percentile":0.52848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2022-12-03T00:00:00Z","modified":"2026-11-03T08:04:09Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"vlc","fixed_in":["3.0.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"vlc","fixed_in":["3.0.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"vlc","fixed_in":["3.0.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"vlc","fixed_in":["3.0.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"vlc","fixed_in":["3.0.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"vlc","fixed_in":["3.0.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vlc","fixed_in":["3.0.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vlc","fixed_in":["3.0.18-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"vlc","fixed_in":["3.0.18-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["3.0.18-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["3.0.18-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"vlc","fixed_in":["3.0.17.4-0+deb10u2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"vlc","fixed_in":["3.0.18-0+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","fixed_in":["2.2.2-5ubuntu0.16.04.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","fixed_in":["3.0.8-0ubuntu18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","fixed_in":["3.0.9.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vlc","fixed_in":["3.0.16-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"vlc","fixed_in":["3.0.18-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"vlc","fixed_in":["3.0.18-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"vlc","fixed_in":["3.0.18-4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.17.4-0+deb10u2"}]}],"versions":["3.0.10-0+deb10u1","3.0.10-1","3.0.10-2","3.0.11-0+deb10u1","3.0.11-1","3.0.11-2","3.0.11-3","3.0.11-3~exp1","3.0.11-3~exp2","3.0.11-4","3.0.11.1-1","3.0.11.1-2","3.0.11.1-3","3.0.12-0+deb10u1","3.0.12-1","3.0.12-2","3.0.12-3","3.0.15-1","3.0.16-1","3.0.17-1","3.0.17.3-1","3.0.17.4-0+deb10u1","3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb10u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"]},{"source":"osv","ecosystem":"Debian:11","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-0+deb11u1"}]}],"versions":["3.0.16-1","3.0.17-1","3.0.17.3-1","3.0.17.4-0+deb11u1","3.0.17.4-1","3.0.17.4-2","3.0.17.4-3","3.0.17.4-4","3.0.17.4-5","3.0.18~rc2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5ubuntu0.16.04.5+esm2"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2","2.2.2-5ubuntu0.16.04.3","2.2.2-5ubuntu0.16.04.4","2.2.2-5ubuntu0.16.04.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1ubuntu0.1~esm1"}]}],"versions":["3.0.8-2","3.0.8-2build1","3.0.8-3","3.0.8-3build1","3.0.8-3build2","3.0.8-3build4","3.0.8-4","3.0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-1ubuntu0.1~esm1"}]}],"versions":["3.0.16-1","3.0.16-1build1","3.0.16-1build2","3.0.16-1build3","3.0.16-1build4","3.0.16-1build5","3.0.16-1build7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5ubuntu0.16.04.5+esm2"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2","2.2.2-5ubuntu0.16.04.3","2.2.2-5ubuntu0.16.04.4","2.2.2-5ubuntu0.16.04.5+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1ubuntu0.1~esm1"}]}],"versions":["3.0.8-2","3.0.8-2build1","3.0.8-3","3.0.8-3build1","3.0.8-3build2","3.0.8-3build4","3.0.8-4","3.0.9.2-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-1ubuntu0.1~esm1"}]}],"versions":["3.0.16-1","3.0.16-1build1","3.0.16-1build2","3.0.16-1build3","3.0.16-1build4","3.0.16-1build5","3.0.16-1build7"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-bp153.2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-bp153.2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-bp155.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-bp155.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-4.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"videolan","product":"vlc_media_player"}],"references":[{"url":"https://twitter.com/0xMitsurugi","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.synacktiv.com/sites/default/files/2022-11/vlc_vnc_int_overflow-CVE-2022-41325.pdf","tags":["x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://www.videolan.org/security/sb-vlc3018.html","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2022/dsa-5297","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41325"},{"url":"https://github.com/advisories/GHSA-xxf6-mj48-xcg3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-41325","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-41325","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-41325","tags":["report"]},{"url":"https://code.videolan.org/videolan/vlc/-/issues/27335","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6180-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25804","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YI4EVQJJHK52U3OVX236TQ775IVEFDQS/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200944","tags":["report"]},{"url":"https://bugzilla.suse.com/1206142","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-0561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41325","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TXMTJ3ZZG5E7QEUM6474V4XEGYBLFI7Q/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M45KVAFI32X55HONDKLE2FBN6GETMIUL/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5217","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-41325","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","status":"published","published":"2022-12-06T00:00:00Z","modified":"2025-04-23T19:35:53.234Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:28.038197Z"}],"euvd":[{"id":"EUVD-2022-44532","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","status":"published","published":"2022-12-06T00:00:00Z","modified":"2025-04-23T19:35:53Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:05.855584Z"}],"ghsa":[{"id":"GHSA-xxf6-mj48-xcg3","title":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows...","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","status":"published","published":"2022-12-06T18:30:19Z","modified":"2023-02-02T05:03:04Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:51:33.931227Z"}],"nvd":[{"id":"CVE-2022-41325","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","status":"published","published":"2022-12-06T16:15:11.173Z","modified":"2026-06-17T05:03:01.973Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"ALPINE-CVE-2022-41325","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","status":"published","published":"2022-12-06T16:15:11.173Z","modified":"2026-11-03T07:30:55.095633568Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"CVE-2022-41325","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","status":"published","published":"2022-12-06T16:15:11.173Z","modified":"2026-03-15T22:44:13.625642Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DEBIAN-CVE-2022-41325","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","status":"published","published":"2022-12-06T16:15:11.173Z","modified":"2026-11-03T08:04:09.995567212Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"UBUNTU-CVE-2022-41325","description":"An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.","status":"published","published":"2022-12-06T16:15:00Z","modified":"2026-04-22T13:23:34.823891Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"DLA-3216-1","title":"vlc - security update","status":"published","published":"2022-12-03T00:00:00Z","modified":"2026-03-09T01:21:41.510267Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5297-1","title":"vlc - security update","status":"published","published":"2022-12-06T00:00:00Z","modified":"2026-03-09T02:09:33.700773Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2022:10252-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\n- Update to version 3.0.18 (CVE-2022-41325, boo#1206142):\n  + macOS: Fix audio device listing with non-latin names.\n  + Misc: Fix rendering and performance issue with older GPUs.\n  + Updated translations.\n- Changes from version 3.0.18-rc2:\n  + Codec/Demux:\n    - Add support for Y16 chroma.\n    - Fix build of gme plugin.\n  + Lua:\n    - Fix script for vocaroo.\n    - Fix script for youtube to allow throttled playback.\n  + Service Discovery: Fix UPnP regression on Windows.\n  + Video Output: Fix video placement with caopengllayer.\n  + Misc: Fix password search in kwallet module.\n- Changes from version 3.0.18-rc:\n  + Demux:\n    - Major adaptive streaming update, notably for multiple\n      timelies and webvtt.\n    - Fix seeking with some fragmented MP4 files.\n    - Add support for DVBSub inside MKV.\n    - Fix some Flac files that could not be played.\n    - Improve seeking in Ogg files.\n  + Decoders:\n    - Fix DxVA/D3D11 crashes on HEVC files with bogus references.\n    - Fix libass storage size and crash.\n    - Fix decoding errors on macOS hw decoding on some HEVC files.\n  + Video Output:\n    - Fix color regression with VAAPI/iOS and OpenGL output.\n    - Fix some resizing issues with OpenGL on GLX/EGL/X11/XV.\n    - Fix Direct3d9 texture stretching.\n    - Fix 10-bit accelerated video filters on macOS.\n  + Playlist: Avoid playlist liveloop on failed/tiny items\n    (temporize EOS bursts).\n  + Misc:\n    - Misc fixes for the extension UI on macOS.\n    - Improve SMBv1 and SMBv2 behaviours.\n    - Improve FTP compatibility.\n    - Support RISC-V.\n    - Fix AVI muxing for Windows Media Player compatibility.\n    - Fix seeking speed on macOS.\n","status":"published","published":"2022-12-27T09:00:21Z","modified":"2026-02-04T04:04:33.417416Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10255-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\n- Update to version 3.0.18 (CVE-2022-41325, boo#1206142):\n  + macOS: Fix audio device listing with non-latin names.\n  + Misc: Fix rendering and performance issue with older GPUs.\n  + Updated translations.\n- Changes from version 3.0.18-rc2:\n  + Codec/Demux:\n    - Add support for Y16 chroma.\n    - Fix build of gme plugin.\n  + Lua:\n    - Fix script for vocaroo.\n    - Fix script for youtube to allow throttled playback.\n  + Service Discovery: Fix UPnP regression on Windows.\n  + Video Output: Fix video placement with caopengllayer.\n  + Misc: Fix password search in kwallet module.\n- Changes from version 3.0.18-rc:\n  + Demux:\n    - Major adaptive streaming update, notably for multiple\n      timelies and webvtt.\n    - Fix seeking with some fragmented MP4 files.\n    - Add support for DVBSub inside MKV.\n    - Fix some Flac files that could not be played.\n    - Improve seeking in Ogg files.\n  + Decoders:\n    - Fix DxVA/D3D11 crashes on HEVC files with bogus references.\n    - Fix libass storage size and crash.\n    - Fix decoding errors on macOS hw decoding on some HEVC files.\n  + Video Output:\n    - Fix color regression with VAAPI/iOS and OpenGL output.\n    - Fix some resizing issues with OpenGL on GLX/EGL/X11/XV.\n    - Fix Direct3d9 texture stretching.\n    - Fix 10-bit accelerated video filters on macOS.\n  + Playlist: Avoid playlist liveloop on failed/tiny items\n    (temporize EOS bursts).\n  + Misc:\n    - Misc fixes for the extension UI on macOS.\n    - Improve SMBv1 and SMBv2 behaviours.\n    - Improve FTP compatibility.\n    - Support RISC-V.\n    - Fix AVI muxing for Windows Media Player compatibility.\n    - Fix seeking speed on macOS.\n","status":"published","published":"2022-12-31T15:39:13Z","modified":"2026-02-04T03:21:47.404754Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0366-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\nUpdate to version 3.0.20:\n\n+ Video Output:\n  - Fix green line in fullscreen in D3D11 video output\n  - Fix crash with some AMD drivers old versions\n  - Fix events propagation issue when double-clicking with mouse wheel\n+ Decoders:\n  - Fix crash when AV1 hardware decoder fails\n+ Interface:\n  - Fix annoying disappearance of the Windows fullscreen controller\n+ Demuxers:\n  - Fix potential security issue (OOB Write) on MMS:// by checking user size bounds\n\nUpdate to version 3.0.19:\n\n+ Core: \n  - Fix next-frame freezing in most scenarios\n+ Demux: \n  - Support RIFF INFO tags for Wav files\n  - Fix AVI files with flipped RAW video planes\n  - Fix duration on short and small Ogg/Opus files\n  - Fix some HLS/TS streams with ID3 prefix\n  - Fix some HLS playlist refresh drift\n  - Fix for GoPro MAX spatial metadata\n  - Improve FFmpeg-muxed MP4 chapters handling\n  - Improve playback for QNap-produced AVI files\n  - Improve playback of some old RealVideo files\n  - Fix duration probing on some MP4 with missing information\n+ Decoders:\n  - Multiple fixes on AAC handling\n  - Activate hardware decoding of AV1 on Windows (DxVA)\n  - Improve AV1 HDR support with software decoding\n  - Fix some AV1 GBRP streams, AV1 super-resolution streams and monochrome ones\n  - Fix black screen on poorly edited MP4 files on Android Mediacodec\n  - Fix rawvid video in NV12\n  - Fix several issues on Windows hardware decoding (including 'too large resolution in DxVA')\n  - Improve crunchyroll-produced SSA rendering\n+ Video Output:\n  - Super Resolution scaling with nVidia and Intel GPUs\n  - Fix for an issue when cropping on Direct3D9\n  - Multiple fixes for hardware decoding on D3D11 and OpenGL interop\n  - Fix an issue when playing -90�rotated video\n  - Fix subtitles rendering blur on recent macOS\n+ Input:\n  - Improve SMB compatibility with Windows 11 hosts\n+ Contribs:\n  - Update of fluidlite, fixing some MIDI rendering on Windows\n  - Update of zlib to 1.2.13 (CVE-2022-37434)\n  - Update of FFmpeg, vpx (CVE-2023-5217), ebml, dav1d, libass\n+ Misc:\n  - Improve muxing timestamps in a few formats (reset to 0)\n  - Fix some rendering issues on Linux with the fullscreen controller\n  - Fix GOOM visualization\n  - Fixes for Youtube playback\n  - Fix some MPRIS inconsistencies that broke some OS widgets on Linux\n  - Implement MPRIS TrackList signals\n  - Fix opening files in read-only mode\n  - Fix password search using the Kwallet backend\n  - Fix some crashes on macOS when switching application\n  - Fix 5.1/7.1 output on macOS and tvOS\n  - Fix several crashes and bugs in the macOS preferences panel\n  - Improvements on the threading of the MMDevice audio output on Windows\n  - Fix a potential security issue on the uninstaller DLLs\n  - Fix memory leaks when using the media_list_player libVLC APIs\n+ Translations:\n  - Update of most translations\n  - New translations to Esperanto, Interlingue, Lao, Macedonian, Burmese, Odia, Samoan and Swahili\n","status":"published","published":"2023-11-12T13:01:02Z","modified":"2026-02-04T03:47:20.787157Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12582-1","title":"libvlc5-3.0.18-4.1 on GA media","description":"These are all security issues fixed in the libvlc5-3.0.18-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:25.193759Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-6180-1","title":"vlc vulnerabilities","description":"It was discovered that VLC could be made to read out of bounds when\ndecoding image files. If a user were tricked into opening a crafted image\nfile, a remote attacker could possibly use this issue to cause VLC to\ncrash, leading to a denial of service. This issue only affected Ubuntu\n16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-19721)\n\nIt was discovered that VLC could be made to write out of bounds when\nprocessing H.264 video files. If a user were tricked into opening a\ncrafted H.264 video file, a remote attacker could possibly use this issue\nto cause VLC to crash, leading to a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS and \nUbuntu 20.04 LTS. (CVE-2020-13428)\n\nIt was discovered that VLC could be made to read out of bounds when\nprocessing AVI video files. If a user were tricked into opening a crafted\nAVI video file, a remote attacker could possibly use this issue to cause\nVLC to crash, leading to a denial of service. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-25801,\nCVE-2021-25802, CVE-2021-25803, CVE-2021-25804)\n\nIt was discovered that the VNC module of VLC contained an arithmetic\noverflow. If a user were tricked into opening a crafted playlist or\nconnecting to a rouge VNC server, a remote attacker could possibly use\nthis issue to cause VLC to crash, leading to a denial of service, or\npossibly execute arbitrary code. (CVE-2022-41325)\n","status":"published","published":"2023-06-20T19:47:23Z","modified":"2026-06-25T13:32:09.557035499Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}