CVE-2024-46461

EUVD-2024-41844
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
videolanvlc_media_player
𝑥
≤ 3.0.20
ADP
Debian logo
Debian Releases
Debian Product
Codename
vlc
bookworm
3.0.21-0+deb12u1
fixed
bookworm (security)
3.0.22-0+deb12u1
fixed
bullseye
3.0.21-0+deb11u1
fixed
bullseye (security)
3.0.21-0+deb11u1
fixed
forky
3.0.22-2
fixed
sid
3.0.22-4
fixed
trixie
3.0.21-10
fixed
trixie (security)
3.0.22-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
vlc
bionic
Fixed 3.0.8-0ubuntu18.04.1+esm3
released
focal
Fixed 3.0.9.2-1ubuntu0.1~esm3
released
jammy
Fixed 3.0.16-1ubuntu0.1~esm3
released
noble
Fixed 3.0.20-3ubuntu0.1~esm1
released
oracular
not-affected
xenial
Fixed 2.2.2-5ubuntu0.16.04.5+esm4
released
Common Weakness Enumeration
References
https://www.videolan.org/security/sb-vlc3021.html