CVE-2018-11529: debian debian_linux Use After Free
Vulnerability summary
CVE-2018-11529 is a high (CVSS 8.0) Use After Free vulnerability in debian debian_linux. EPSS estimates a 36.97% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 11-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.0HighCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.0HighCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
36.97%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 36.97% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (seclists.org)
Maturity: unknown
VLC Media Player - MKV Use-After-Free (Metasploit)
Maturity: weaponized
VLC Media Player MKV Use After Free
exploit/windows/fileformat/vlc_mkv
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian2 products
- vlc< 3.0.3-1-1 | < 3.0.3-1-0+deb9u1
- debian_linuxEOL9.0
Mageia1 product
- vlc< 3.0.4-1.mga6 | < 3.0.4-1.mga6.tainted
Ubuntu1 product
- vlc< 2.1.6-0ubuntu14.04.5+esm1 | < 2.2.2-5ubuntu0.16.04.5+esm1
Videolan1 product
- vlc_media_player≤ 2.2.8
4 vendors · 5 products
References
11 links- seclists.org/fulldisclosure/2018/Jul/28Mailing ListX Refsource FULLDISCExploitThird Party AdvisoryREPORT
