CVE-2017-8311: Videolan Vlc Media Player

High severity, CVSS 7.8. EPSS: 8.8% chance of exploitation in the next 30 days.

Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.

Affected products

• Videolan Vlc Media Player: up to and including 2.2.4

Published 2017-05-23. Last modified 2026-06-17.