An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://bugs.gentoo.org/721940 Exploit, Patch, Third Party Advisory
- https://www.videolan.org/security/ Vendor Advisory
- https://bugs.gentoo.org/721940 Exploit, Patch, Third Party Advisory
- https://www.videolan.org/security/ Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.8 · videolanNVD modified 2026-10-08 22:16
Affected (CPE criteria) 1
cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*
References 8
- http://hg.libsdl.org/SDL_image/ Release Notes, Third Party Advisory
- https://bugs.gentoo.org/721940 Exploit, Patch, Third Party Advisory
- https://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=72afe7ebd8305bf4f5360293b8621cde52ec506b
- https://www.videolan.org/security/ Vendor Advisory
- http://hg.libsdl.org/SDL_image/ Release Notes, Third Party Advisory
- https://bugs.gentoo.org/721940 Exploit, Patch, Third Party Advisory
- https://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=72afe7ebd8305bf4f5360293b8621cde52ec506b
- https://www.videolan.org/security/ Vendor Advisory