CVE-2010-3124

VLC Media Player <1.1.3 - RCE

Title source: llm
STIX 2.1

Description

Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.

Exploits (2)

exploitdb WORKING POC
by Secfence · textlocalwindows
https://www.exploit-db.com/exploits/14750
nomisec WORKING POC 1 stars
by KOBUKOVUI · poc
https://github.com/KOBUKOVUI/DLL_Injection_On_VLC

References (7)

Core 7
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/2172
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2010/08/25/9
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/14750
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/41107
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2010/08/25/10
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12190

Scores

EPSS 0.0839
EPSS Percentile 92.4%

Details

Status published
Products (50)
videolan/vlc_media_player 0.1.99b
videolan/vlc_media_player 0.1.99e
videolan/vlc_media_player 0.1.99f
videolan/vlc_media_player 0.1.99g
videolan/vlc_media_player 0.1.99h
videolan/vlc_media_player 0.1.99i
videolan/vlc_media_player 0.2.0
videolan/vlc_media_player 0.2.60
videolan/vlc_media_player 0.2.61
videolan/vlc_media_player 0.2.62
... and 40 more
Published Aug 26, 2010
Tracked Since Feb 18, 2026