Heap-based buffer overflow in VLC Media Player - CVE-2020-13428

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the hxxx_AnnexB_to_xVC() function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player when processing H.264 Annex-B video files. A remote attacker can create a specially crafted .avi file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

How to mitigate CVE-2020-13428

Sources

• http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=d5c43c21c747ff30ed19fcca745dea3481c733e0
• https://github.com/videolan/vlc/commits/master/modules/packetizer/hxxx_nal.c
• https://github.com/videolan/vlc-3.0/releases/tag/3.0.11