CVE-2018-11529

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.

Metrics

CVSS 3.0 8.0/10CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2018/Jul/28Exploit, Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1041311Third Party Advisory, VDB Entry
https://www.debian.org/security/2018/dsa-4251Third Party Advisory
https://www.exploit-db.com/exploits/45626/Exploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/28Exploit, Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1041311Third Party Advisory, VDB Entry
https://www.debian.org/security/2018/dsa-4251Third Party Advisory
https://www.exploit-db.com/exploits/45626/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jul 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-11537.4Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in t CVE-2018-115319.8Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.CVE-2018-115326.1An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject f CVE-2018-115359.8An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable u CVE-2018-115369.8md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.CVE-2018-115376.5Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of th CVE-2018-115388.8servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSR CVE-2018-11548.8In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of CVE-2018-115419.8A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privil CVE-2018-115429.8A Remote Command Execution (RCE) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the execution of arb CVE-2018-115437.5A Local File Inclusion (LFI) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the downloading of arbit CVE-2018-115449.8The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/dat