PT-2020-6647 · Videolan+3 · Vlc Media Player+3

Zhen Zhou · Published 2020-08-05 · Updated 2025-08-04 · CVE-2021-25801

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions VideoLAN VLC Media Player version 3.0.11

Description A buffer overflow vulnerability in the Parse indx component of VideoLAN VLC Media Player allows attackers to cause an out-of-bounds read via a crafted .avi file. This vulnerability is related to buffer copying without input validation, which can be exploited by a remote attacker to gain access to confidential data and cause a denial of service.

Recommendations For version 3.0.11, consider disabling the Parse indx component until a patch is available to prevent exploitation via crafted .avi files. Restrict access to .avi files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-120

Related Identifiers

ALT-PU-2020-2503

ALT-PU-2020-3056

BDU:2022-02240

CVE-2021-25801

DLA-2728-1

DSA-4834-1

USN-6180-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Vlc Media Player

References · 22

• https://ubuntu.com/security/CVE-2019-19721 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6180-1 · Vendor Advisory
• https://code.videolan.org/videolan/vlc-3.0/-/commit/f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-25801 · Security Note
• https://ubuntu.com/security/CVE-2020-13428 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-25801 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02240 · Security Note
• https://ubuntu.com/security/CVE-2021-25803 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25801 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-25801 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25801 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25801 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25802 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2728-1 · Vendor Advisory