CVE-2017-8313: Videolan Vlc Media Player

Medium severity, CVSS 5.5. EPSS: 1.5% chance of exploitation in the next 30 days.

Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.

Affected products

• Videolan Vlc Media Player: up to and including 2.2.4

Published 2017-05-23. Last modified 2026-06-17.