CVE-2016-3941: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of service (crash) via a crafted wav file, related to "seek across EOF."

Affected products

• Canonical Ubuntu Linux: version 14.04 only
• Videolan Vlc Media Player: up to and including 2.1.6

Published 2016-04-18. Last modified 2026-06-17.