PT-2021-3542 · Videolan+2 · Vlc Media Player+2

Zhen Zhou · Published 2020-12-29 · Updated 2025-08-05 · CVE-2020-26664

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VLC media player version 3.0.11

Description A heap-based buffer overflow issue exists in the EbmlTypeDispatcher::send function of VLC media player, which can be triggered by a crafted .mkv file. This allows attackers to potentially gain access to confidential information or cause a denial of service.

Recommendations For version 3.0.11, consider updating to a newer version to mitigate the risk, as the current version is affected by a heap-based buffer overflow issue in the EbmlTypeDispatcher::send function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2020-3565

ALT-PU-2021-2847

BDU:2021-03626

CVE-2020-26664

DLA-3050-1

DSA-4834-1

OPENSUSE-SU-2021:0076-1

OPENSUSE-SU-2021:0091-1

OPENSUSE-SU-2021:0121-1

OPENSUSE-SU-2021:0122-1

OPENSUSE-SU-2021:0691-1

OPENSUSE-SU-2021:0714-1

OPENSUSE-SU-2021_0076-1

OPENSUSE-SU-2021_0091-1

OPENSUSE-SU-2021_0691-1

OPENSUSE-SU-2024:11502-1

Affected Products

Alt Linux

Suse

Vlc Media Player

References · 61

• 🔥 https://gist.githubusercontent.com/henices/db11664dd45b9f322f8514d182aef5ea/raw/d56940c8bf211992bf4f3309a85bb2b69383e511/CVE-2020-26664.txt · Exploit
• https://osv.dev/vulnerability/CVE-2020-26664 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0714-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26664 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0121-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=47416144 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4834-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03626 · Security Note
• https://osv.dev/vulnerability/DLA-3050-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26664 · Vendor Advisory
• http://videolan.com · Vendor Advisory
• https://debian.org/security/2021/dsa-4834 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0076-1 · Vendor Advisory