VideoLAN, a project and a non-profit organization.

Security Advisory 1801

Summary           : Heap use after free during SWF file playback
Date              : July 2018
Affected versions : VLC media player 3.0.0 and 3.0.1 
ID                : VideoLAN-SA-1801
CVE reference     : CVE-2018-11516


A remote user can create a specially crafted swf file that, when loaded by the target user, will trigger a heap use after free in Demux() (demux/avformat/demux.c)


If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.

Threat mitigation

Exploitation of those issues requires the user to explicitly open a specially crafted file or stream.

ASLR and DEP help reduce exposure, but may be bypassed.


The user should refrain from opening files from untrusted third parties or accessing untrusted remote sites (or disable the VLC browser plugins), until the patch is applied.


VLC media player 3.0.2 addresses the issue.


The VideoLAN project
VLC official GIT repository