CVE-2008-0984 in the critical feed json
The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwri…
published 2008-02-26 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-0991
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.3%
- EPSS 15.3% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.
Patch / fix
- vlc Debian 14, Debian 13, Debian 12 0.8.6.e-1
debian advisories DEBIAN-CVE-2008-0984
Timeline
- Published
- First public exploit (EDB-5498)
Exploit prediction
15.28% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-5498 Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow local, 2008-04-25
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-399 Resource Management Errors
References
-
videolan.org
/security/sa0802.html
patch
-
debian.org
/security/2008/dsa-1543
vendor-advisory
-
gentoo.org
/security/en/glsa/glsa-200803-13.xml
vendor-advisory
-
secunia.com
/advisories/29122
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/29284
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/29153
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/29766
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2008/0682
vdb-entry, vendor-advisory
-
securityfocus.com
/bid/28007
vdb-entry
-
securitytracker.com
/id?1019510
vdb-entry
-
lists.grok.org.uk
/pipermail/full-disclosure/2008-February/060481.html
mailing-list
-
securityfocus.com
/archive/1/488841/100/0/threaded
mailing-list
- coresecurity.com /?action=item&id=2147
Sources
- CVE List CVE-2008-0984
- NVD CVE-2008-0984
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.