VideoLAN VLC Media Player Out-of-Bounds Read Vulnerability in MMS Protocol

A vulnerability allowing an out-of-bounds read and denial-of-service has been identified in VideoLAN VLC media player versions prior to 3.0.22. This issue arises in the 'mmstu.c' file, where a crafted 0x01 response from an MMS server can be exploited.

Impact

Exploitation of this vulnerability leads to a crash of the VLC media player, causing a denial-of-service condition. While this issue primarily causes the application to crash, there is a possibility that it could be combined with other vulnerabilities to leak user information or execute code remotely. However, such code execution has not been observed in practice.

Remediation

Users can upgrade to VLC media player version 3.0.22 to address this vulnerability. Until the patch is applied, it is recommended to avoid opening files or streams from untrusted sources and to disable VLC browser plugins.