CVE-2010-3907: Videolan Vlc Media Player

High severity, CVSS 9.3. EPSS: 5.8% chance of exploitation in the next 30 days.

Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a zero i_subpackets value in a Real Media file, leading to a heap-based buffer overflow.

Affected products

• Videolan Vlc Media Player: up to and including 1.1.5; version 0.1.99b only; version 0.1.99e only; version 0.1.99f only; version 0.1.99g only; version 0.1.99h only; …

Published 2011-01-03. Last modified 2026-06-16.