CVE-2014-9630: Videolan Vlc Media Player

High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days.

The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.

Affected products

• Videolan Vlc Media Player: before 2.1.6 (fixed in 2.1.6)

Published 2020-01-24. Last modified 2026-06-17.