--- title: "VideoLAN vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/videolan type: vendor description: "VideoLAN has 139 published CVEs, 0 in CISA KEV and 73 with public exploits." updated: 2026-10-23 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # VideoLAN vulnerabilities - **Published CVEs:** 139 - **In CISA KEV:** 0 - **With a public exploit:** 73 - **With a patch:** 127 - **Average CVSS:** 7.3 - **CVEs in the last two years:** 11 - **First CVE:** 2007-01-03 - **Latest CVE:** 2026-10-23 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 30 | | High | 53 | | Medium | 54 | | Low | 2 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [VLC media player](https://radicalnotion.ai/vendor/videolan/vlc-media-player) | 117 | | [vlc-3.0](https://radicalnotion.ai/vendor/videolan/vlc-3-0) | 30 | | [VLC](https://radicalnotion.ai/vendor/videolan/vlc) | 23 | | [vlc-android](https://radicalnotion.ai/vendor/videolan/vlc-android) | 3 | | [libbluray](https://radicalnotion.ai/vendor/videolan/libbluray) | 3 | | [VLC for Android](https://radicalnotion.ai/vendor/videolan/vlc-for-android) | 3 | | [libdvdnav](https://radicalnotion.ai/vendor/videolan/libdvdnav) | 2 | | [dav1d](https://radicalnotion.ai/vendor/videolan/dav1d) | 2 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 40 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 16 | | [CWE-189](https://radicalnotion.ai/cwe/cwe-189) | Numeric Errors | 12 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 7 | | [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 6 | | [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 6 | | [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 5 | | [CWE-190](https://radicalnotion.ai/cwe/cwe-190) | Integer Overflow or Wraparound | 4 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [mitre](https://radicalnotion.ai/cna/mitre) | 96 | | [redhat](https://radicalnotion.ai/cna/redhat) | 20 | | [VulnCheck](https://radicalnotion.ai/cna/vulncheck) | 10 | | [checkpoint](https://radicalnotion.ai/cna/checkpoint) | 4 | | [flexera](https://radicalnotion.ai/cna/flexera) | 4 | | [hackerone](https://radicalnotion.ai/cna/hackerone) | 3 | | [canonical](https://radicalnotion.ai/cna/canonical) | 1 | | [Google](https://radicalnotion.ai/cna/google) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2019 | 19 | | 2020 | 10 | | 2021 | 5 | | 2022 | 1 | | 2023 | 4 | | 2024 | 2 | | 2025 | 0 | | 2026 | 11 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-115724 | VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider | low | 2.1 | 0.1% | No | 2026-10-23 | | CVE-2026-112283 | libbluray through 1.5.1 Uncontrolled Memory Allocation via \_parse\_extent\_start\_points | medium | 6.8 | 0.2% | No | 2026-10-19 | | CVE-2026-112282 | VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi\_access\_point | medium | 6.8 | 0.2% | No | 2026-10-19 | | CVE-2026-112058 | libdvdnav through 7.0.0 Out-of-Bounds Read via set\_PTT JumpTT | medium | 6.8 | 0.2% | No | 2026-10-18 | | CVE-2026-112057 | libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav\_describe\_title\_chapters | medium | 6.8 | 0.2% | No | 2026-10-18 | | CVE-2026-102875 | VLC media player before 3.0.24 Path Traversal via skins2 | high | 8.5 | 0.2% | No | 2026-09-29 | | CVE-2026-73324 | VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability | medium | 5.3 | 0.2% | No | 2026-09-09 | | CVE-2026-56711 | VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability | high | 7.3 | 0.1% | No | 2026-09-09 | | CVE-2026-26227 | VLC for Android \< 3.7.0 Remote Access OTP Authentication Bypass | medium | 6.3 | 0.3% | No | 2026-02-26 | | CVE-2026-26228 | VLC for Android \< 3.7.0 Remote Access Path Traversal | low | 2.3 | 0.3% | No | 2026-02-26 | | CVE-2025-51602 | - | medium | 4.8 | 0.4% | No | 2026-01-16 | | CVE-2024-46461 | - | high | 8.0 | 0.6% | No | 2024-09-25 | ## Frequently asked questions ### How many CVEs does VideoLAN have? VideoLAN has 139 published CVE records since 2007, including 11 in the last two years. ### How many VideoLAN CVEs are in CISA KEV? None of VideoLAN's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Which VideoLAN products have the most CVEs? The VideoLAN products with the most published CVEs are VLC media player, vlc-3.0, VLC, vlc-android, libbluray. ### What are the most common weakness types in VideoLAN CVEs? VideoLAN's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-125 (Out-of-bounds Read), CWE-189 (Numeric Errors), CWE-20 (Improper Input Validation). ### Are there public exploits for VideoLAN vulnerabilities? Yes — 73 of VideoLAN's CVEs have a known public exploit. ### How many critical VideoLAN vulnerabilities are there? VideoLAN has 30 critical and 53 high-severity CVEs. ### What is the average severity of VideoLAN CVEs? The average CVSS base score across VideoLAN's scored CVEs is 7.3. ## Related vendors - [Kubernetes](https://radicalnotion.ai/vendor/kubernetes) (140 CVEs) - [ruby-lang](https://radicalnotion.ai/vendor/rubylang) (140 CVEs) - [AncoraThemes](https://radicalnotion.ai/vendor/ancorathemes) (140 CVEs) - [anisha](https://radicalnotion.ai/vendor/anisha) (140 CVEs) - [Avaya](https://radicalnotion.ai/vendor/avaya) (140 CVEs) - [Asterisk](https://radicalnotion.ai/vendor/asterisk) (139 CVEs) - [NLnet Labs](https://radicalnotion.ai/vendor/nlnet-labs) (139 CVEs) - [envoyproxy](https://radicalnotion.ai/vendor/envoyproxy) (138 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/videolan). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.