VLC Media Player Vulnerable to Double Free and Buffer Overflow Vulnerabilities

On June 21, researchers at PenTestPartners published a blog about their discovery of multiple vulnerabilities in the VideoLan VLC Media Player including a “high-risk double free issue” that is identified as CVE-2019-12874.

VideoLan published an advisory for two vulnerabilities, the double free flaw as well as a heap buffer overflow vulnerability that is identified as CVE-2019-5439.

According to the advisory, a remote attacker that convinces a user to open either a “specially crafted file or stream” would be able to achieve remote code execution with privileges under the current user or cause VLC to crash.

Both vulnerabilities are addressed in VLC media player 3.0.7 or later. Users are advised to update as soon as possible.

Tenable plugins to identify these vulnerabilities will appear here as they’re released.