CVE-2008-5276: Videolan Vlc Media Player

High severity, CVSS 9.3. EPSS: 7.8% chance of exploitation in the next 30 days.

Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.

Affected products

• Videolan Vlc Media Player: version 0.9.0 only; version 0.9.1 only; version 0.9.2 only; version 0.9.3 only; version 0.9.4 only; version 0.9.5 only; …

Published 2008-12-03. Last modified 2026-06-16.