CVE-2011-2194

CVE-2011-2194 describes an integer overflow vulnerability in the XSPF playlist parser of VideoLAN VLC media player versions 0.8.5 through 1.1.9. This flaw allows remote attackers to trigger a heap-based buffer overflow, leading to a denial of service (crash) and potentially arbitrary code execution. With a CVSS score of 9.3, this vulnerability is considered critical due to its network-based attack vector, medium complexity, and high impact on confidentiality, integrity, and availability. While not listed in the KEV catalog, a local file integer overflow exploit for VLC 1.1.9 is available on ExploitDB, indicating public exploit code exists, though there is no evidence of active exploitation or significant community discussion.