CVE-2011-2588: Videolan Vlc Media Player

Medium severity, CVSS 6.8. EPSS: 3.7% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the AVI_ChunkRead_strf function in libavi.c in the AVI demuxer in VideoLAN VLC media player before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted AVI media file.

Affected products

• Videolan Vlc Media Player: up to and including 1.1.10.1; version 0.1.99b only; version 0.1.99e only; version 0.1.99f only; version 0.1.99g only; version 0.1.99h only; …

Published 2011-07-27. Last modified 2026-06-16.