CVE-2026-102875
HighCVSS 7.8Summary
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.
Risk Assessment
The risk includes the ability to write arbitrary files on the system with VLC user privileges, potentially leading to malicious code execution and system compromise.
Recommendation
It is recommended to upgrade VLC to version 3.0.24 or later, which includes a fix for this vulnerability. Also avoid opening skins from untrusted sources.
Other vulnerabilities in VLC media player
See all- CVE-2019-13962Critical
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
- CVE-2026-73324Medium
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
- CVE-2026-56711High
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.
- CVE-2020-26664High
A vulnerability in the EbmlTypeDispatcher::send function of VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
- CVE-2019-19721High
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. This may be related to the SDL_Image product.
- CVE-2019-5459High
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
- CVE-2019-13602High
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
Original NVD description (English source)
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS