CVE-2022-41325

An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.

• CWE-190
• CWE-190

• https://twitter.com/0xMitsurugiThird Party Advisory
• https://www.debian.org/security/2022/dsa-5297Third Party Advisory
• https://www.synacktiv.com/sites/default/files/2022-11/vlc_vnc_int_overflow-CVE-2022-41325.pdfExploit, Patch, Third Party Advisory
• https://www.videolan.org/security/sb-vlc3018.htmlVendor Advisory
• https://twitter.com/0xMitsurugiThird Party Advisory
• https://www.debian.org/security/2022/dsa-5297Third Party Advisory
• https://www.synacktiv.com/sites/default/files/2022-11/vlc_vnc_int_overflow-CVE-2022-41325.pdfExploit, Patch, Third Party Advisory
• https://www.videolan.org/security/sb-vlc3018.htmlVendor Advisory

Published

Dec 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41319A Reflected Cross-Site Scripting (XSS) vulnerability affects…6.1
• CVE-2022-4132A flaw was found in JSS. A memory leak in JSS requires non-s…5.9
• CVE-2022-41320Veritas System Recovery (VSR) versions 18 and 21 store a net…6.5
• CVE-2022-41322In Kitty before 0.26.2, insufficient validation in the deskt…7.8
• CVE-2022-41323In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 befor…7.5
• CVE-2022-41324Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4…6.5
• CVE-2022-41326The web conferencing component of Mitel MiCollab through 9.6…9.8
• CVE-2022-41327A cleartext transmission of sensitive information vulnerabil…4.4
• CVE-2022-41328A improper limitation of a pathname to a restricted director…7.1
• CVE-2022-41329An exposure of sensitive information to an unauthorized acto…5.3
• CVE-2022-4133Rejected reason: We were unable to verify this vulnerbility.
• CVE-2022-41330An improper neutralization of input during web page generati…6.1