CVE-2008-4686: Videolan Vlc Media Player

High severity, CVSS 9.3. EPSS: 9.9% chance of exploitation in the next 30 days.

Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.

Affected products

• Videolan Vlc Media Player: version 0.9.0 only; version 0.9.1 only; version 0.9.2 only; version 0.9.3 only; version 0.9.4 only

Published 2008-10-22. Last modified 2026-06-16.