CVE-2017-8312: Debian Linux

Medium severity, CVSS 5.5. EPSS: 1.4% chance of exploitation in the next 30 days.

Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file.

Affected products

• Debian Debian Linux: version 8.0 only
• Videolan Vlc Media Player: before 2.2.6 (fixed in 2.2.6)

Published 2017-05-23. Last modified 2026-06-17.