CVE-2013-6934: LIVE555 Streaming Media

High severity, CVSS 7.5. EPSS: 28.2% chance of exploitation in the next 30 days.

The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.

Affected products

• LIVE555 Streaming Media: version 2013-11-26 only
• Videolan Vlc Media Player: before 2.1.0 (fixed in 2.1.0)

Published 2014-01-23. Last modified 2026-06-17.