Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

VLC Media Player can crash or be hijacked by bad streams

CVE-2008-0296 · published 18 years ago
Summary

Versions of VLC Media Player up to 0.8.6d on Windows have a flaw in the Real RTSP plugin. A malicious streaming server could send a specially crafted request that crashes the program or runs unwanted code. Update VLC to a newer version or apply the vendor's patch to protect your systems.

What to do
  • Update debian vlc to version 0.8.6.c-6.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian vlc < 0.8.6.c-6
Fix: upgrade to 0.8.6.c-6
Debian:13 debian vlc < 0.8.6.c-6
Fix: upgrade to 0.8.6.c-6
Debian:14 debian vlc < 0.8.6.c-6
Fix: upgrade to 0.8.6.c-6
– videolan vlc_media_player <= 0.8.6d
cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*
Original advisory text
Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RTSP servers to cause a denial of service (application cras...
Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RTSP servers to cause a denial of service (application crash) or execute arbitrary code via a long string.
References
Severity
10.0 Critical
Exploitation
15% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published16 Jan 2008
Updated14 Oct 2026
First seen20 Sep 2026
Sources
DEBIAN-CVE-2008-0296 · OSV
CVE-2008-0296 · NVD
Track software like this
Free during beta