Users are highly recommended to update their media player software to VLC 3.0.7 or later versions and should avoid opening or playing video files from untrusted third parties. VLC media player supports many audio and video. It is a cross-platform media player, with versions for Microsoft Windows, Mac OS X, GNU/Linux, BeOS, MorphOS, BSD, Solaris, iOS, and eComStation. Paraschoudis used honggfuzz fuzzing tool to discover this issue and four other bugs, which were also patched by the VideoLAN team earlier this month along with 28 other bugs reported by other security researchers through EU-FOSSA bug bounty program. VLC media player (also known as VLC) is a highly portable free and open-source media player and streaming media server written by the VideoLAN project. Well, that's not a tough job, as attackers can easily target hundreds of thousands of users within hours by simply releasing malicious video files on torrent sites, mimicking as a pirated copy of a newly released movie or TV series.Īccording to an advisory released by VideoLAN, having ASLR and DEP protections enabled on the system could help users mitigate the threat, but developers did admit that these protections could be bypassed too.

Though the proof-of-concepts demonstrated by both researchers cause a crash, a potential attacker can exploit these vulnerabilities to achieve arbitrary code execution with the same privileges as of the target user on the system.Īll the attacker needs to do is craft a malicious MKV or AVI video file and trick users into playing it using the vulnerable versions of VLC.

What is team what is vlc media player