Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Videolan

First CVE: Jan 3, 2007Active for: 20 yearsTotal CVEs: 128
56.5
VTI Score
TOP TARGET

Videolan maintains a tightly focused portfolio centered on VLC Media Player and related multimedia libraries (including dav1d and libbluray) that achieve exceptionally broad distribution across consumer devices, media centers, and cross-platform endpoints. The vendor's vulnerability profile, despite a narrow product count, reflects the complexity inherent to audio and video codec parsing and memory management: recurring exposures cluster around buffer-boundary violations, out-of-bounds reads and writes, and input-validation weaknesses that are characteristic of media-processing attack surfaces. A meaningful share of Videolan's disclosures reach serious severity, and the vendor's vulnerabilities frequently acquire public exploit code, consistent with the accessibility and popularity of VLC's user-facing attack surface. Defenders should treat VLC codec libraries as high-risk components in their environments given their ubiquity and the media-parsing demands they handle; current severity, exploitation activity, and exposure counts are shown alongside this summary.

FAUCET AI Generated
128
Total CVEs
More Total CVEs than 99% of tracked vendors
1.3
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 76% of tracked vendors
7.4
Avg CVSS Score
Higher Avg CVSS Score than 56% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Videolan over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jan 3, 2007
19 years ago
Most Recent CVE
Jan 16, 2026
189 days ago

Products(5 total)

Top CVEs

Signals from CVEs in this vendor scope (128 CVEs).

128 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2010-3275HIGH
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a "dangling pointer
Mar 28, 20119.385NOYES
CVE-2008-4654HIGH
Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbi
Oct 22, 20089.377NOYES
CVE-2012-1775HIGH
Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.
Mar 19, 20129.372NOYES
CVE-2011-0531HIGH
demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary comm
Feb 7, 20119.372NOYES
CVE-2008-5036HIGH
Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle f
Nov 10, 20089.372NOYES
CVE-2018-11529HIGH
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts w
Jul 11, 20188.068NOYES
CVE-2011-0522MEDIUM
The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/codec/subtitles/subsusf.c) in VideoLAN VLC Media Player 1.1 befo
Feb 7, 20116.862NOYES
CVE-2009-2484HIGH
Stack-based buffer overflow in the Win32AddConnection function in modules/access/smb.c in VideoLAN VLC media player 0.9.9, when running on Microsoft Windows, allows remote attacker
Jul 16, 20099.361NOYES
CVE-2016-5108CRITICAL
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or
Jun 8, 20169.856NOYES
CVE-2010-3124HIGH
Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct D
Aug 26, 20109.344NOYES
View all 128 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products128 CVEs
38%
57%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local37 (28.9%)
Network18 (14.1%)
Unknown71 (55.5%)
Physical1 (0.8%)
Adjacent Network1 (0.8%)
Attack Complexity
Low54 (42.2%)
High3 (2.3%)
Unknown71 (55.5%)
User Interaction
None17 (13.3%)
Unknown71 (55.5%)
Required40 (31.3%)
Privileges Required
Low5 (3.9%)
High0 (0.0%)
None52 (40.6%)
Unknown71 (55.5%)

Exploit Exposure

Signals from CVEs in this vendor scope (128 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
7 CVEs
5.5% of CVEs· 98th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
39 CVEs
30.5% of CVEs· 79th percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Videolan.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Videolan — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Videolan's Products

View all 6 CNAs →

Top CWEs