CVE-2017-8310: Videolan Vlc Media Player

Medium severity, CVSS 5.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file.

Affected products

• Videolan Vlc Media Player: version 2.2.0 only; version 2.2.1 only; version 2.2.2 only; version 2.2.3 only; version 2.2.4 only; version 2.2.5 only

Published 2017-05-23. Last modified 2026-06-17.