CVE-2017-8313

CVE-2017-8313 describes a heap out-of-bounds read vulnerability in VideoLAN VLC Media Player versions prior to 2.2.5. This flaw, stemming from a missing string termination check in the ParseJSS function, allows an attacker to craft a malicious subtitles file that, when processed, can cause the application to read data beyond allocated memory. The vulnerability carries a CVSS v3 score of 5.5 (Medium), indicating a local attack vector with low complexity, requiring user interaction, and primarily leading to a denial of service (application crash) without impacting confidentiality or integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.