CVE-2024-46461: Integer Overflow
Last updated 30 January 2025
Other sources
VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vlcto a version that resolves this vulnerability.Fixed in 3.0.21-0+deb12u1 - Upgrade
Upgrade
debian/vlcto a version that resolves this vulnerability.Fixed in 3.0.21-1 - Upgrade
Upgrade
debian/vlcto a version that resolves this vulnerability.Fixed in 3.0.23-0+deb12u1Fixed in 3.0.24-0+deb12u1Fixed in 3.0.23-0+deb13u1Fixed in 3.0.24-0+deb13u1Fixed in 3.0.24-4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46461?
CVE-2024-46461 has been classified as a denial of service vulnerability.
How do I fix CVE-2024-46461?
To fix CVE-2024-46461, upgrade VLC media player to version 3.0.21 or later.
What products are affected by CVE-2024-46461?
CVE-2024-46461 affects VLC media player versions 3.0.20 and earlier.
What could happen if CVE-2024-46461 is exploited?
Exploitation of CVE-2024-46461 could lead to a crash of VLC media player or remote code execution.
Who is the vendor of the software affected by CVE-2024-46461?
The vendor of the affected software is VideoLAN.