CVE-2008-5276

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-12-03 · updated 2026-06-16
Weakness: CWE-189

Description

Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.

Affected products

VideoLAN VLC: 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5 (+3)

References

http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d19de4e9f2211cbe5bde00726b66c47a424f4e07
http://secunia.com/advisories/32942
http://secunia.com/advisories/33315
http://security.gentoo.org/glsa/glsa-200812-24.xml
http://securityreason.com/securityalert/4680
http://www.osvdb.org/50333
http://www.securityfocus.com/archive/1/498768/100/0/threaded
http://www.securityfocus.com/bid/32545
http://www.trapkit.de/advisories/TKADV2008-013.txt
http://www.videolan.org/security/sa0811.html
http://www.vupen.com/english/advisories/2008/3287
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14793

Get alerted when CVE-2008-5276 or the next vulnerability affects your stack