Veille CVE

Recherche « videolan vlc »

4 CVE

Critique 0 Élevée 2 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « videolan vlc » ✕
  1. CVE-2026-115724 2.9 Faible

    VideoLAN VLC for Android

    VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.

  2. CVE-2026-102875 7.8 Élevée

    videolan vlc

    VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.

  3. CVE-2026-73324 4.3 Moyenne

    VideoLAN VLC media player

    Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.

  4. CVE-2026-56711 7.0 Élevée

    VideoLAN VLC media player

    VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.