CVE-2014-9627

The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.

• CWE-704

• http://openwall.com/lists/oss-security/2015/01/20/5Mailing List, Patch, Third Party Advisory
• https://github.com/videolan/vlc/commit/2e7c7091a61aa5d07e7997b393d821e91f593c39Patch, Third Party Advisory
• https://www.videolan.org/security/sa1501.htmlVendor Advisory
• http://openwall.com/lists/oss-security/2015/01/20/5Mailing List, Patch, Third Party Advisory
• https://github.com/videolan/vlc/commit/2e7c7091a61aa5d07e7997b393d821e91f593c39Patch, Third Party Advisory
• https://www.videolan.org/security/sa1501.htmlVendor Advisory

Published

Jan 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9621The ELF parser in file 5.16 through 5.21 allows remote attac…
• CVE-2014-9622Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no…
• CVE-2014-9623OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and ea…
• CVE-2014-9624CAPTCHA bypass vulnerability in MantisBT before 1.2.19.
• CVE-2014-9625The GetUpdateFile function in misc/update.c in the Updater i…7.8
• CVE-2014-9626Integer underflow in the MP4_ReadBox_String function in modu…7.8
• CVE-2014-9628The MP4_ReadBox_String function in modules/demux/mp4/libmp4.…7.8
• CVE-2014-9629Integer overflow in the Encode function in modules/codec/sch…7.8
• CVE-2014-9630The rtp_packetize_xiph_config function in modules/stream_out…7.8
• CVE-2014-9632The TDI driver (avgtdix.sys) in AVG Internet Security before…
• CVE-2014-9633The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows…
• CVE-2014-9634Jenkins before 1.586 does not set the secure flag on session…