CVE-2017-8313

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-23 · updated 2026-06-17
Weakness: CWE-125

Description

Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.

Affected products

VideoLAN VLC: through 2.2.4

References

http://git.videolan.org/?p=vlc/vlc-2.2.git%3Ba=commitdiff%3Bh=05b653355ce303ada3b5e0e645ae717fea39186c
http://www.debian.org/security/2017/dsa-3899
http://www.securityfocus.com/bid/98633
https://security.gentoo.org/glsa/201707-10
http://git.videolan.org/?p=vlc/vlc-2.2.git%3Ba=commitdiff%3Bh=05b653355ce303ada3b5e0e645ae717fea39186c
http://www.debian.org/security/2017/dsa-3899
http://www.securityfocus.com/bid/98633
https://security.gentoo.org/glsa/201707-10

Get alerted when CVE-2017-8313 or the next vulnerability affects your stack