VideoLAN, a project and a non-profit organization.

Security Advisory 1601

Summary           : Buffer Overflow in Processing QuickTime IMA Files
Date              : June 2016
Affected versions : VLC media player 2.2.3 and earlier
ID                : VideoLAN-SA-1601
CVE reference     : CVE-2016-5108


A remote user can create a specially crafted QuickTime IMA file that, when loaded by the target user, will trigger a buffer overflow in DecodeAdpcmImaQT() in 'modules/codec/adpcm.c'.


If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.

Threat mitigation

Exploitation of those issues requires the user to explicitly open a specially crafted file or stream.

ASLR and DEP help reduce exposure, but may be bypassed.




VLC media player 2.2.4 addresses the issue.


The VideoLAN project
VLC official GIT repository