CVE-2017-17670: Debian Linux

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.

Affected products

• Debian Debian Linux: version 9.0 only
• Videolan Vlc Media Player: up to and including 2.2.8

Published 2017-12-15. Last modified 2026-06-17.