Skip to main content

VLC Media Player and MPlayer contain critical vulnerability bugs

VLC Media Player on a laptop
Audio player loading…

If you use the popular media players VLC or MPlayer, then you’ll want to make sure you have the most recent updates installed as soon as possible, as security researchers have identified a critical vulnerability that puts your PC at risk.

Cisco Talos Intelligence Group, the security research company, has found that there is a critical remote code execution vulnerability in the LIVE555 media streaming library, which is used by VLC, MPlayer and other popular media players.

According to the findings (opens in new tab), this vulnerability is found in a flaw in the HTTP packet parsing functionality, which analyzes HTTP headers for RTSP tunneling over HTTP.

Lilith Wyatt, a researcher at the Cisco Talos Intelligence Group, explained in a blog post (opens in new tab) that “an exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.”

Get updating

If you have media playing software that uses the LIVE555 media streaming library, such as VLC, then you’ll want to make sure you update to the latest version, as an update has been released that addresses the issue.

The speed in which a fix has been found and released shows how worrying this vulnerability is, and how it put PCs in risk of a cyber attack from malicious users.

Although VLC is a very popular free media player, and often used as an alternative to Windows Media Player and other media playing tools included in Windows over the years, it’s also had its fair share of security problems.

As HackRead explains (opens in new tab), critical security flaws have been found in the past, such as in version 2.0.5, while last year Kodi, VLC and Popcorn time were found to be vulnerable to hackers who could hijack computers via subtitle files.

Hopefully, this latest vulnerability is a wakeup call to VLC and other media players to make sure their products are completely secure, otherwise users may start looking elsewhere.

Matt Hanson
Matt Hanson


Matt is TechRadar's Managing Editor for Computing and Entertainment, looking after two of the best, and most exciting, channels on the site. Having written for a number of publications such as PC Plus, PC Format, T3 and Linux Format, there's no aspect of technology that Matt isn't passionate about, especially computing and PC gaming. Ever since he got an Amiga A500+ for Christmas in 1991, he's loved using (and playing on) computers, and will talk endlessly about how The Secret of Monkey Island is the best game ever made. He's also a huge film and TV fan and Marvel geek, and his favorite recent film is Dune.