A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.8 · videolan, debianNVD modified 2026-10-08 22:16
Affected (CPE criteria) 3
cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
References 8
- https://gist.githubusercontent.com/henices/db11664dd45b9f322f8514d182aef5ea/raw/d56940c8bf211992bf4f3309a85bb2b69383e511/CVE-2020-26664.txt Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/06/msg00012.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202101-37 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4834 Third Party Advisory
- https://gist.githubusercontent.com/henices/db11664dd45b9f322f8514d182aef5ea/raw/d56940c8bf211992bf4f3309a85bb2b69383e511/CVE-2020-26664.txt Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/06/msg00012.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202101-37 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4834 Third Party Advisory