What You Need to Know:

VideoLAN, the organization behind the popular VLC Media Player, has disclosed multiple critical vulnerabilities that could allow attackers to execute arbitrary code remotely. These vulnerabilities affect the desktop version of the software. The security advisory is identified as SB-VLC3021.

What Is the Risk?

• Trigger: The vulnerability can be triggered by a maliciously crafted MMS stream.
• Arbitrary Code Execution: This means attackers can make VLC Media Player run harmful commands on your computer. This could lead to serious issues such as your computer crashing or attackers taking control of your system.
• High Impact: This vulnerability can cause your VLC Media Player to crash, allow attackers to steal your information, or let them install and run harmful software on your computer.

What is a MMS Stream?

• Definition: MMS stands for Microsoft Media Server. It is a streaming protocol used to transfer multimedia content (such as videos and audio) over the internet.
• Usage: MMS streams are often used for live broadcasts or streaming video content directly from a server to a media player, like VLC.

How It Works:

• Trigger: The issue is caused when a specially designed MMS stream is opened in VLC Media Player.
• Mechanism: The flaw, known as an integer overflow, happens when VLC tries to process more data than it can handle. This causes VLC to make a mistake and allows attackers to insert and run harmful commands on your computer.

What Should You Do?

1. Update Your Software:

• Why: The VLC development team has fixed this issue in VLC Media Player version 3.0.21.
• How: To update VLC Media Player, follow these steps:

1. Open VLC Media Player.
2. Go to Help > Check for Updates.
3. Follow the prompts to download and install the latest version.
4. ***If you attempt to update through the VLC media player and receive a dialogue box stating that you have the latest version of VLC media player when in fact you do not, visit the official videolan.org site and proceed to download and install the latest version from there.***

• Check Regularly: Ensure your software is set to update automatically or check regularly for updates to ensure you are always protected.

2. Avoid Untrusted MMS Streams:

• Why: Exploiting this vulnerability requires you to open a maliciously crafted MMS stream.
• How: Refrain from opening MMS streams from untrusted sources. Be cautious with any MMS streams you receive, and only open them if you are sure they are safe.