CVE-2012-0023

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-10-30 · updated 2026-06-16
Weakness: CWE-399

Description

Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.

Affected products

VideoLAN VLC: 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5 (+28)

References

http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=7d282fac1cc455b5a5eca2bb56375efcbf879b06
http://secunia.com/advisories/47325
http://securitytracker.com/id?1026449
http://www.openwall.com/lists/oss-security/2012/10/29/5
http://www.openwall.com/lists/oss-security/2012/10/30/9
http://www.osvdb.org/77975
http://www.securityfocus.com/bid/51231
http://www.videolan.org/security/sa1108.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/71916
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15893
http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=7d282fac1cc455b5a5eca2bb56375efcbf879b06
http://secunia.com/advisories/47325

Get alerted when CVE-2012-0023 or the next vulnerability affects your stack