CVE-2022-41325

Katalog CVE

CVSS 7.8 · High EPSS 0,68%

Kerentanan Integer Overflow or Wraparound pada videolan vlc media player, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.

Rincian

Terbit di NVD

6 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.videolan.org/security/sb-vlc3018.html advisory vendor
• https://www.synacktiv.com/sites/default/files/2022-11/vlc_vnc_int_overflow-CVE-2022-41325.pdf exploit · patch · advisory pihak ketiga
• https://twitter.com/0xMitsurugi advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5297 advisory pihak ketiga