CVE-2023-47360
7.5 HIGHVideolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length
Published: 2023-11-07 · Last updated: 2026-05-28
Severity and scoring
- CVSS
- 7.5 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CWE
- CWE-191
Affected products
| Vendor | Product |
|---|---|
| videolan | vlc_media_player |
Description
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2023-47360
- [Exploit reference]https://0xariana.github.io/blog/real_bugs/vlc/mms
- [Other]https://lists.debian.org/debian-lts-announce/2023/11/msg00034.html
- [Exploit reference]https://0xariana.github.io/blog/real_bugs/vlc/mms
- [Other]https://lists.debian.org/debian-lts-announce/2023/11/msg00034.html
Related CVEs
Same vendor
- CVE-2023-47359 — Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket()... (9.8 CRITICAL)
Same CWE
- CVE-2026-54413 — driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() fu... (8.2 HIGH)
- CVE-2026-54412 — LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_respons... (8.2 HIGH)
- CVE-2026-47222 — NanaZip is the 7-Zip derivative intended for the modern Windows experience (5.4 MEDIUM)
- CVE-2026-11850 — An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c (5.0 MEDIUM)
- CVE-2026-42542 — TDengine is an open source, time-series database optimized for Internet of Things devices (7.5 HIGH)