Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read…

Description

Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file.

Scores

EPSS (exploitation in 30 days)

1.3% · top 30% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

• Allows attacker to read data beyond allocated memory and potentially crash the process (causing a denial of service)
• CWE-125 (opens in a new tab)All about CWE-125 and its CVEs

Affected products

• VideoLAN · VLC

  • affected 2.2.*

References (4)

• GLSA-201707-10 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 98638 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://git.videolan.org/?p=vlc/vlc-2.2.git%3Ba=blobdiff%3Bf=modules/codec/subsdec.c%3Bh=addd8c71f30d53558fffd19059b374be45cf0f8e%3Bhp=1b4276e299a2a6668047231d29ac705ae93076ba%3Bhb=7cac839692ab79dbfe5e4ebd4c4e37d9a8b1b328%3Bhpb=3477dba3d506de8d95bccef2c6b67861188f6c29 (opens in a new tab)x_refsource_CONFIRMx_transferred
• DSA-3899 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-8310](https://trackcve.app/badge/CVE-2017-8310.svg)](https://trackcve.app/cve/CVE-2017-8310)

Record last updated 5 Aug 2024, 16:34 UTC.