VLC Media Player and MPlayer contain critical vulnerability bugs

If you use the popular media players VLC or MPlayer, then you’ll want to make sure you have the most recent updates installed as soon as possible, as security researchers have identified a critical vulnerability that puts your PC at risk.

Cisco Talos Intelligence Group, the security research company, has found that there is a critical remote code execution vulnerability in the LIVE555 media streaming library, which is used by VLC, MPlayer and other popular media players.

According to the findings, this vulnerability is found in a flaw in the HTTP packet parsing functionality, which analyzes HTTP headers for RTSP tunneling over HTTP.

Lilith Wyatt, a researcher at the Cisco Talos Intelligence Group, explained in a blog post that “an exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.”

Get updating

If you have media playing software that uses the LIVE555 media streaming library, such as VLC, then you’ll want to make sure you update to the latest version, as an update has been released that addresses the issue.

The speed in which a fix has been found and released shows how worrying this vulnerability is, and how it put PCs in risk of a cyber attack from malicious users.

Although VLC is a very popular free media player, and often used as an alternative to Windows Media Player and other media playing tools included in Windows over the years, it’s also had its fair share of security problems.

As HackRead explains, critical security flaws have been found in the past, such as in version 2.0.5, while last year Kodi, VLC and Popcorn time were found to be vulnerable to hackers who could hijack computers via subtitle files.

Hopefully, this latest vulnerability is a wakeup call to VLC and other media players to make sure their products are completely secure, otherwise users may start looking elsewhere.