CVE-2025-51602: 
VLC media player vulnerability analysis and mitigation

CVE-2025-51602 is an out-of-bounds read vulnerability in VideoLAN VLC media player affecting versions before 3.0.22. The flaw resides in mmstu.c and can be triggered by a crafted 0x01 response from a malicious MMS (Microsoft Media Server) server, resulting in denial of service. It was published on January 16, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium), assigned by MITRE (NVD, VideoLAN Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and is located in the mmstu.c source file, which handles MMS (Microsoft Media Server) streaming protocol communication in VLC. When VLC connects to a malicious MMS server that returns a specially crafted 0x01 response packet, insufficient bounds checking causes the player to read memory beyond the intended buffer boundary. Exploitation requires no authentication or user interaction beyond connecting to a malicious server, though the attack complexity is rated High, suggesting specific conditions must be met to trigger the flaw (NVD, VideoLAN Issue Tracker).

Successful exploitation results in an out-of-bounds memory read and denial of service, causing VLC to crash when processing the malicious MMS server response. The CVSS scoring indicates low integrity and low availability impact with no confidentiality impact, meaning sensitive data exposure is not a primary concern but application stability is affected. The scope is limited to the VLC process itself, with no evidence of lateral movement potential or privilege escalation (NVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-51602. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039%, indicating a very low probability of exploitation in the near term. Detection coverage exists via Nessus plugin 303381 (Tenable).

1. Set up a malicious MMS server: Configure a server to respond to MMS protocol connections with a crafted 0x01 response packet that contains malformed or out-of-bounds data.
2. Lure the victim: Trick a user running VLC (version < 3.0.22) into opening an mms:// or mmst:// URL pointing to the attacker-controlled server — for example, via a malicious link or playlist file.
3. Trigger the out-of-bounds read: When VLC's mmstu.c processes the crafted 0x01 response, it reads beyond the allocated buffer boundary.
4. Achieve denial of service: The out-of-bounds read causes VLC to crash, completing the denial-of-service objective (NVD, VideoLAN Issue Tracker).

• Network: Unexpected outbound connections from VLC to unknown MMS servers (mms:// or mmst:// protocol on TCP port 1755); MMS server responses containing anomalous 0x01 packet types with unusual payload lengths.
• Logs: Application crash logs or Windows Error Reporting entries referencing vlc.exe or libvlccore with access violation or read fault at unexpected memory addresses.
• Process: VLC process terminating unexpectedly (crash) immediately after initiating an MMS stream connection to an external or unfamiliar host.

VideoLAN has released VLC media player version 3.0.22, which addresses this vulnerability. Users should upgrade to version 3.0.22 or later as the primary remediation. As a workaround, users can avoid opening mms:// URLs from untrusted sources. Debian LTS users can apply the security update announced via the Debian LTS mailing list (VideoLAN Advisory, Debian LTS).

The SANS Internet Stormcast podcast briefly covered VLC and Apache Nimble patches in January 2026, noting the VideoLAN security update (SANS ISC). Community coverage has been limited, consistent with the moderate severity rating of the vulnerability. No significant vendor statements beyond the official VideoLAN security bulletin have been identified.