High severity7.8NVD Advisory· Published Jun 8, 2020· Updated Jun 17, 2026
CVE-2020-13428
CVE-2020-13428
Description
A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8- VideoLAN/VLC media playerdescription
- Range: <3.0.11
- osv-coords5 versionspkg:rpm/opensuse/vlc&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/vlc&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/vlc&distro=openSUSE%20Tumbleweedpkg:rpm/suse/vlc&distro=SUSE%20Package%20Hub%2015%20SP1pkg:rpm/suse/vlc&distro=SUSE%20Package%20Hub%2015%20SP2
< 3.0.11.1-lp151.6.12.1+ 4 more
- (no CPE)range: < 3.0.11.1-lp151.6.12.1
- (no CPE)range: < 3.0.11.1-lp152.2.9.1
- (no CPE)range: < 3.0.16-1.5
- (no CPE)range: < 3.0.11.1-bp151.5.12.1
- (no CPE)range: < 3.0.11.1-bp152.2.9.1
Patches
Vulnerability mechanics
References
5- github.com/videolan/vlc/commits/master/modules/packetizer/hxxx_nal.cnvdPatchThird Party Advisory
- github.com/videolan/vlc-3.0/releases/tag/3.0.11nvdRelease NotesThird Party Advisory
- www.debian.org/security/2020/dsa-4704nvdThird Party Advisory
- www.videolan.org/security/sb-vlc3011.htmlnvdVendor Advisory
- git.videolan.orgnvd
News mentions
0No linked articles in our index yet.