Cloudanix VulnDB

CVE-2022-41325

High · 7.8

CVSS

7.8

EPSS

0.7%

Published

Dec 6, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A popular media player can be tricked into crashing or letting attackers take control of the computer when someone opens a specially made playlist or connects to a malicious server.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer overflow in the VNC module triggers memory corruption that can lead to process crash or arbitrary code execution when processing crafted input.

Why it matters to the business

Users of the media player on desktops and servers face risk of system compromise or service disruption from opening untrusted playlists or VNC connections; the issue remains unpatched in listed distributions despite public exploit code and high elapsed time since disclosure.

How an attack unfolds

An attacker prepares a malicious playlist file or hosts a rogue VNC server, then entices the victim to open the file or connect; the integer overflow is triggered during VNC handling, resulting in memory corruption that may allow code execution under certain conditions.

How to fix it

Upgrade VLC Media Player to the latest stable release that resolves the integer overflow; monitor vendor advisories for backported fixes in Debian and other distributions; disable VNC module if unused.

How to confirm the fix worked

Verify installed VLC version is newer than 3.0.17.4; attempt reproduction with known proof-of-concept inputs in a controlled environment; confirm absence of crashes or unexpected behavior during VNC handling.

Typical attack path

  1. Prepare crafted playlist file or rogue VNC server
  2. Social-engineer victim into opening the file or initiating connection
  3. Trigger integer overflow in VNC module
  4. Achieve memory corruption leading to crash or code execution

How to detect it

Review system and application logs for VLC crashes during playlist or VNC operations; inspect process creation events following media file access; correlate with user reports of unexpected behavior after opening playlists.

What your security team should do

  • Immediately update VLC across all endpoints to the newest release
  • Restrict opening of untrusted playlists and external VNC connections
  • Monitor exploit availability and EPSS trend for any increase in activity
  • Apply compensating controls such as application sandboxing or network segmentation for media players

The record

An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 vlc 0 3.0.17.4-0+deb10u2
Debian:11 vlc 0 3.0.18-0+deb11u1
Debian:12 vlc 0 3.0.18-1
Debian:13 vlc 0 3.0.18-1
SUSE:Package Hub 15 SP3 vlc 0 3.0.18-bp153.2.6.1
SUSE:Package Hub 15 SP4 vlc 0 3.0.18-bp154.2.3.1
SUSE:Package Hub 15 SP5 vlc 0 3.0.20-bp155.2.3.1
Ubuntu:20.04:LTS vlc 0 No fix
Ubuntu:22.04:LTS vlc 0 No fix
Ubuntu:Pro:16.04:LTS vlc 0 2.2.2-5ubuntu0.16.04.5+esm2
Ubuntu:Pro:18.04:LTS vlc 0 3.0.8-0ubuntu18.04.1+esm1
Ubuntu:Pro:20.04:LTS vlc 0 3.0.9.2-1ubuntu0.1~esm1
Ubuntu:Pro:22.04:LTS vlc 0 3.0.16-1ubuntu0.1~esm1
openSUSE:Leap 15.3 vlc 0 3.0.18-bp153.2.6.1
openSUSE:Leap 15.4 vlc 0 3.0.18-bp154.2.3.1
openSUSE:Leap 15.5 vlc 0 3.0.20-bp155.2.3.1
openSUSE:Tumbleweed vlc 0 3.0.18-4.1

Related vulnerabilities