--- title: "VideoLAN VLC media player vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/videolan/vlc-media-player type: product description: "VideoLAN VLC media player has 117 published CVEs, 0 in CISA KEV and 61 with public exploits." updated: 2026-09-09 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # VideoLAN VLC media player vulnerabilities Vendor: [VideoLAN](https://radicalnotion.ai/vendor/videolan) - **Published CVEs:** 117 - **In CISA KEV:** 0 - **With a public exploit:** 61 - **With a patch:** 108 - **Average CVSS:** 7.5 - **First CVE:** 2007-01-03 - **Latest CVE:** 2026-09-09 - **Platforms:** libavcodec, windows, windows nt ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 29 | | High | 49 | | Medium | 39 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 36 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 13 | | [CWE-189](https://radicalnotion.ai/cwe/cwe-189) | Numeric Errors | 11 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 6 | | [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 6 | | [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 5 | | [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 5 | | [CWE-120](https://radicalnotion.ai/cwe/cwe-120) | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 4 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2015 | 4 | | 2016 | 2 | | 2017 | 8 | | 2018 | 3 | | 2019 | 18 | | 2020 | 10 | | 2021 | 5 | | 2022 | 1 | | 2023 | 3 | | 2024 | 1 | | 2025 | 0 | | 2026 | 3 | ## Affected versions (top 24 of 188) | Version | Kind | CVEs | | --- | --- | --- | | 0.9.2 | range | 28 | | 0.9.3 | range | 27 | | 0.9.4 | range | 27 | | 0.9.5 | range | 25 | | 0.8.6 | range | 24 | | 1.0.0 | range | 24 | | 0.9.6 | range | 23 | | 0.9.8a | range | 23 | | 0.9.9 | range | 23 | | 1.0.1 | range | 23 | | 1.0.2 | range | 23 | | 1.0.3 | range | 23 | | 2.1.6 | patched | 6 | | 2.0.7 | patched | 2 | | 3.0.20 | patched | 2 | | 3.0.7 | patched | 2 | | 2.1.0 | patched | 1 | | 2.2.1 | patched | 1 | | 2.2.6 | patched | 1 | | 3.0.11 | patched | 1 | | 3.0.12 | patched | 1 | | 3.0.19 | patched | 1 | | 3.0.22 | patched | 1 | | 3.0.3 | patched | 1 | ## CVEs (first 30 of 117, most severe first) | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-73324 | VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability | medium | 5.3 | No | No | Yes | | CVE-2026-56711 | VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability | high | 7.3 | No | No | Yes | | CVE-2025-51602 | - | medium | 4.8 | No | No | Yes | | CVE-2024-46461 | - | high | 8.0 | No | No | Yes | | CVE-2023-46814 | - | high | 7.8 | No | No | Yes | | CVE-2023-47360 | - | high | 7.5 | No | Yes | Yes | | CVE-2023-47359 | - | critical | 9.8 | No | Yes | Yes | | CVE-2022-41325 | - | high | 7.8 | No | Yes | Yes | | CVE-2021-25804 | - | high | 7.5 | No | No | Yes | | CVE-2021-25803 | - | high | 7.1 | No | No | Yes | | CVE-2021-25802 | - | high | 7.1 | No | No | Yes | | CVE-2021-25801 | - | high | 7.1 | No | No | Yes | | CVE-2020-26664 | - | high | 7.8 | No | Yes | Yes | | CVE-2020-13428 | - | high | 7.8 | No | No | Yes | | CVE-2019-19721 | - | high | 7.8 | No | Yes | Yes | | CVE-2013-3564 | - | medium | 5.3 | No | No | Yes | | CVE-2013-3565 | - | medium | 6.1 | No | Yes | Yes | | CVE-2014-9625 | - | high | 7.8 | No | No | Yes | | CVE-2014-9626 | - | high | 7.8 | No | No | Yes | | CVE-2014-9627 | - | high | 7.8 | No | No | Yes | | CVE-2014-9628 | - | high | 7.8 | No | No | Yes | | CVE-2014-9629 | - | high | 7.8 | No | No | Yes | | CVE-2014-9630 | - | high | 7.8 | No | No | Yes | | CVE-2019-18278 | - | high | 7.8 | No | Yes | No | | CVE-2019-14970 | - | high | 7.8 | No | No | Yes | | CVE-2019-14777 | - | high | 7.8 | No | No | Yes | | CVE-2019-14778 | - | high | 7.8 | No | No | Yes | | CVE-2019-14776 | - | high | 7.8 | No | No | Yes | | CVE-2019-14533 | - | high | 7.8 | No | No | Yes | | CVE-2019-14534 | - | medium | 5.5 | No | No | Yes | ## Frequently asked questions ### How many CVEs does VideoLAN VLC media player have? VideoLAN VLC media player has 117 published CVE records since 2007. ### How many VideoLAN VLC media player CVEs are in CISA KEV? None of VideoLAN VLC media player's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for VideoLAN VLC media player vulnerabilities? Yes — 61 of VideoLAN VLC media player's CVEs have a known public exploit. ### Which versions of VideoLAN VLC media player are affected? 188 distinct VideoLAN VLC media player versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in VideoLAN VLC media player CVEs? VideoLAN VLC media player's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-125 (Out-of-bounds Read), CWE-189 (Numeric Errors), CWE-20 (Improper Input Validation). ### How many critical VideoLAN VLC media player vulnerabilities are there? VideoLAN VLC media player has 29 critical and 49 high-severity CVEs. ### What is the average severity of VideoLAN VLC media player CVEs? The average CVSS base score across VideoLAN VLC media player's scored CVEs is 7.5. ## Other products from this vendor - [vlc-3.0](https://radicalnotion.ai/vendor/videolan/vlc-3-0) (29 CVEs) - [VLC](https://radicalnotion.ai/vendor/videolan/vlc) (23 CVEs) - [libbluray](https://radicalnotion.ai/vendor/videolan/libbluray) (3 CVEs) - [vlc-android](https://radicalnotion.ai/vendor/videolan/vlc-android) (3 CVEs) - [VLC for Android](https://radicalnotion.ai/vendor/videolan/vlc-for-android) (3 CVEs) - [dav1d](https://radicalnotion.ai/vendor/videolan/dav1d) (2 CVEs) - [libdvdnav](https://radicalnotion.ai/vendor/videolan/libdvdnav) (2 CVEs) - [vlc for mobile](https://radicalnotion.ai/vendor/videolan/vlc-for-mobile) (1 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/videolan/vlc-media-player). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.