CVE-2017-8311: videolan vlc
CVSS: 7.8v3.0HighModified
AliasesUBUNTU-CVE-2017-8311DEBIAN-CVE-2017-8311
Published 23-05-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-8311 is a high (CVSS 7.8) vulnerability in videolan vlc. EPSS estimates a 8.84% chance of exploitation in the next 30 days, higher than 95.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.8/10
010
High · v3.0 (NVD)EPSS score
8.84%
0%100%
Low · -1.95 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 23-05-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
8.84%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-1.95 pp
From 10.79% on 21-09-2026
21-09-202621-10-2026
EPSS score8.84%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundVLC Media Player/Kodi/PopcornTime 'Red Chimera' < 2.2.5 - Memory Corruption (PoC)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Videolan2 products
- vlc< 2.2.5
- vlc_media_player≤ 2.2.4
Debian1 product
- vlc< 2.2.5-1
Ubuntu1 product
- vlc< 2.1.6-0ubuntu14.04.3 | < 2.2.2-5ubuntu0.16.04.3
3 vendors · 4 products
