SecPod

Learn Search

Search across all Learn content

← Back to Expressions & POVs
ALERT: VLC Vetineri receives an important update

ALERT: VLC Vetineri receives an important update

Jun 10, 2019By Vidita V Koushik2 min read

VLC released a minor update for Vetineri, the 3.0.x release line of VLC Media Player. This has been considered an important update as it received 33 security bug fixes. Jean-Baptiste Kempf, the president of VideoLAN non-profit org, pointed out that this release has fixed the highest number of security issues so far.

The two major security issues in this release are :

  • An Out-of-Bounds Write Error in the faad2 library, a dependency of VLC. This flaw affects only the 3.0.x release line.
  • A Stack Buffer Overflow Error in the RIST module.

The version 4.0 of VLC is in the beta stage. Therefore, the current version of VLC is 3.0.7.

VLC also reported that there are 21 medium security issues and 10 low-security issues that were fixed in the 3.0.7 release. These include multiple buffer overflow errors, use after free errors, integer underflow and overflow errors,  NULL pointer dereferences, floating point exception errors, infinite loop error, etc.

The low-security bugs are not exploitable and they have no actual impact. The medium-security bugs though are exploitable and can crash the application.

VLC attributes the increase in the number of security issues to a bug bounty program funded by the European Commission during the FOSSA program.

The latest release has also brought out improvements for Blu-ray support and  HDR support on Windows, including HLG streams.

Impact:

An attacker can exploit the out-of-bounds write vulnerability leading to a denial of service or code execution in some cases.

Affected Products:

VLC Media Player before version 3.0.7

Solution:

Upgrade to version 3.0.7 of VLC Media Player.

Please refer to this KB article.

Featured Posts

Open The Most Effective Vulnerability Assessment Framework What Makes One Effective
The Most Effective Vulnerability Assessment Framework What Makes One Effective

Point of View

The Most Effective Vulnerability Assessment Framework What Makes One Effective

No single named standard makes a vulnerability assessment framework effective. This piece covers NIST, ISO, and CIS Controls, then breaks down what actually separates a working framework from a checklist, coverage, risk based prioritization, cadence, ownership, and a feedback loop.

Sep 11, 2026

Open Threat and Vulnerability Assessment How Risk Actually Gets Calculated
Threat and Vulnerability Assessment How Risk Actually Gets Calculated

Point of View

Threat and Vulnerability Assessment How Risk Actually Gets Calculated

A vulnerability alone doesn't tell the whole risk story. This piece breaks down how a threat and vulnerability assessment pairs technical weaknesses with real attacker context, walks through the six step process, and covers frameworks like NIST 800-30 and ISO 27005.

Sep 11, 2026

Open Vulnerability Assessment Services: What to Look For
Vulnerability Assessment Services: What to Look For

Point of View

Vulnerability Assessment Services: What to Look For

Choosing a vulnerability assessment provider means asking about actual coverage, scan frequency, and whether findings come with real prioritization or just a CVSS dump. This piece breaks down what strong vulnerability assessment services include, red flags to avoid, and questions to ask before signing.

Sep 11, 2026

Open Agentic AI Vulnerability Assessment What Changes and What Does Not
Agentic AI Vulnerability Assessment What Changes and What Does Not

Point of View

Agentic AI Vulnerability Assessment What Changes and What Does Not

Agentic AI is expanding what a vulnerability assessment needs to cover, autonomous agents bring their own credentials, tool access, and memory, adding a genuinely new asset class alongside servers and endpoints. It's also compressing attacker timelines and introducing risk categories like goal hijacking and tool misuse that don't map to a traditional CVE. But the core discipline hasn't changed: the same lifecycle of scoping, scanning, prioritizing, and remediating still applies, human judgment still drives prioritization, and accountability still sits with the people who deployed the agent, not the agent itself.

Sep 9, 2026