--- title: "VideoLAN VLC vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/videolan/vlc type: product description: "VideoLAN VLC has 23 published CVEs, 0 in CISA KEV and 8 with public exploits." updated: 2026-09-29 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # VideoLAN VLC vulnerabilities Vendor: [VideoLAN](https://radicalnotion.ai/vendor/videolan) - **Published CVEs:** 23 - **In CISA KEV:** 0 - **With a public exploit:** 8 - **With a patch:** 23 - **Average CVSS:** 6.9 - **First CVE:** 2008-01-17 - **Latest CVE:** 2026-09-29 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 1 | | High | 11 | | Medium | 11 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 6 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 4 | | [CWE-120](https://radicalnotion.ai/cwe/cwe-120) | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 3 | | [CWE-191](https://radicalnotion.ai/cwe/cwe-191) | Integer Underflow (Wrap or Wraparound) | 1 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 1 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | | [CWE-264](https://radicalnotion.ai/cwe/cwe-264) | Permissions, Privileges, and Access Controls | 1 | | [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2017 | 5 | | 2018 | 0 | | 2019 | 0 | | 2020 | 6 | | 2021 | 0 | | 2022 | 0 | | 2023 | 0 | | 2024 | 0 | | 2025 | 0 | | 2026 | 3 | ## Affected versions (top 25 of 125) | Version | Kind | CVEs | | --- | --- | --- | | 3.0.0 | exact | 2 | | 3.0.0-1 | exact | 2 | | 3.0.0-2 | exact | 2 | | 3.0.0-git | exact | 2 | | 3.0.0-rc1 | exact | 2 | | 3.0.0-rc2 | exact | 2 | | 3.0.0-rc3 | exact | 2 | | 3.0.0-rc4 | exact | 2 | | 3.0.0-rc5 | exact | 2 | | 3.0.0-rc6 | exact | 2 | | 3.0.0-rc7 | exact | 2 | | 3.0.0-rc8 | exact | 2 | | 0.8.6d | range | 5 | | 0.8.6e | range | 5 | | 0.4.6 | range | 3 | | 0.5.0 | range | 3 | | 0.5.1 | range | 3 | | 0.5.2 | range | 3 | | 0.5.3 | range | 3 | | 0.6.0 | range | 3 | | 0.6.1 | range | 3 | | 0.6.2 | range | 3 | | 0.7.0 | range | 3 | | 0.7.1 | range | 3 | | 3.0.24 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-102875 | VLC media player before 3.0.24 Path Traversal via skins2 | high | 8.5 | No | No | Yes | | CVE-2026-73324 | VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability | medium | 5.3 | No | No | Yes | | CVE-2026-56711 | VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability | high | 7.3 | No | No | Yes | | CVE-2014-9625 | - | high | 7.8 | No | No | Yes | | CVE-2014-9626 | - | high | 7.8 | No | No | Yes | | CVE-2014-9627 | - | high | 7.8 | No | No | Yes | | CVE-2014-9628 | - | high | 7.8 | No | No | Yes | | CVE-2014-9629 | - | high | 7.8 | No | No | Yes | | CVE-2014-9630 | - | high | 7.8 | No | No | Yes | | CVE-2017-8313 | - | medium | 5.5 | No | No | Yes | | CVE-2017-8312 | - | medium | 5.5 | No | No | Yes | | CVE-2017-8311 | - | high | 7.8 | No | Yes | Yes | | CVE-2017-8310 | - | medium | 5.5 | No | No | Yes | | CVE-2014-6440 | - | critical | 9.8 | No | Yes | Yes | | CVE-2008-2147 | - | medium | 4.6 | No | No | Yes | | CVE-2008-1769 | - | medium | 6.8 | No | Yes | Yes | | CVE-2008-1768 | - | medium | 6.8 | No | No | Yes | | CVE-2008-1881 | - | medium | 6.8 | No | Yes | Yes | | CVE-2008-1489 | - | medium | 6.8 | No | Yes | Yes | | CVE-2007-6684 | - | medium | 5.0 | No | No | Yes | | CVE-2007-6683 | - | medium | 5.0 | No | Yes | Yes | | CVE-2007-6682 | - | high | 7.5 | No | Yes | Yes | | CVE-2007-6681 | - | high | 7.5 | No | Yes | Yes | ## Frequently asked questions ### How many CVEs does VideoLAN VLC have? VideoLAN VLC has 23 published CVE records since 2008. ### How many VideoLAN VLC CVEs are in CISA KEV? None of VideoLAN VLC's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for VideoLAN VLC vulnerabilities? Yes — 8 of VideoLAN VLC's CVEs have a known public exploit. ### Which versions of VideoLAN VLC are affected? 125 distinct VideoLAN VLC versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in VideoLAN VLC CVEs? VideoLAN VLC's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-125 (Out-of-bounds Read), CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')), CWE-191 (Integer Underflow (Wrap or Wraparound)). ### How many critical VideoLAN VLC vulnerabilities are there? VideoLAN VLC has 1 critical and 11 high-severity CVEs. ### What is the average severity of VideoLAN VLC CVEs? The average CVSS base score across VideoLAN VLC's scored CVEs is 6.9. ## Other products from this vendor - [VLC media player](https://radicalnotion.ai/vendor/videolan/vlc-media-player) (117 CVEs) - [vlc-3.0](https://radicalnotion.ai/vendor/videolan/vlc-3-0) (29 CVEs) - [libbluray](https://radicalnotion.ai/vendor/videolan/libbluray) (3 CVEs) - [vlc-android](https://radicalnotion.ai/vendor/videolan/vlc-android) (3 CVEs) - [VLC for Android](https://radicalnotion.ai/vendor/videolan/vlc-for-android) (3 CVEs) - [dav1d](https://radicalnotion.ai/vendor/videolan/dav1d) (2 CVEs) - [libdvdnav](https://radicalnotion.ai/vendor/videolan/libdvdnav) (2 CVEs) - [vlc for mobile](https://radicalnotion.ai/vendor/videolan/vlc-for-mobile) (1 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/videolan/vlc). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.