CVE-2026-102875: 
VLC media player vulnerability analysis and mitigation

CVE-2026-102875 is a path traversal vulnerability in VLC media player's skins2 ThemeLoader component that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files containing path traversal sequences to write arbitrary files with VLC user privileges, ultimately enabling code execution via Lua script injection. All VLC versions before 3.0.24 are affected; version 3.0.24 resolves the issue. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically in modules/gui/skins2/src/theme_loader.cpp, where the ThemeLoader does not sanitize or validate archive member names before extracting them from .vlt skin files (GitHub Advisory). An attacker crafts a malicious .vlt archive containing entries with path traversal sequences (e.g., ../../) that, when extracted, write files to arbitrary locations on the filesystem with the privileges of the VLC process. The attack vector is local and requires user interaction — specifically, the victim must open or load the malicious skin file — but no privileges are required from the attacker. Code execution is achieved by injecting a malicious Lua script into a location where VLC will subsequently load and execute it (VulnCheck Advisory).

Successful exploitation grants an attacker arbitrary file write capability with the privileges of the VLC user, which can be escalated to arbitrary code execution through Lua script injection. The confidentiality, integrity, and availability of the affected system are all rated High, meaning an attacker could read sensitive files, modify system data, or disrupt system operation. The scope is limited to the vulnerable system (no lateral movement to subsequent systems is indicated), but the impact on the local user's environment is total (GitHub Advisory, Red Hat Bugzilla).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation status as "none" and notes the vulnerability is not automatable, requiring passive user interaction. The EPSS score is approximately 0.167% (6th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft malicious skin archive: Create a .vlt skin archive file containing one or more entries with path traversal sequences in their member names (e.g., ../../.config/vlc/malicious.lua), embedding a malicious Lua script as the file content.
2. Deliver the malicious file: Distribute the crafted .vlt file to the target via social engineering, a malicious download link, or by placing it in a location the user is likely to access (e.g., a shared drive or email attachment).
3. Trigger skin loading: Convince the victim to load the malicious skin file in VLC (e.g., via Tools > Preferences > Interface > Use custom skin, or by double-clicking the .vlt file if associated with VLC).
4. Achieve arbitrary file write: When VLC's skins2 ThemeLoader extracts the archive without validating member names, the malicious Lua script is written to the attacker-controlled path outside the intended skin directory.
5. Execute injected Lua code: VLC loads the dropped Lua script during normal operation (e.g., at startup or when the extension is triggered), executing the attacker's payload with VLC user privileges and achieving code execution (GitHub Advisory, VulnCheck Advisory).

• File System: Unexpected .lua files written outside the VLC skins directory (e.g., in ~/.config/vlc/lua/, user home directory, or system directories); newly created or modified files with timestamps coinciding with VLC skin loading events.
• File System: Presence of suspicious .vlt files in download directories, temporary folders, or email attachment locations.
• Logs: VLC log entries referencing skin archive extraction with unusual or unexpected file paths; errors or warnings from theme_loader.cpp related to archive member extraction.
• Process: Unexpected child processes spawned by the VLC process (e.g., shell commands, network utilities) following skin file loading.
• Network: Outbound connections from the VLC process to unknown external IP addresses or domains shortly after a skin file is loaded, potentially indicating a reverse shell or data exfiltration payload.

VideoLAN has released VLC media player version 3.0.24, which addresses this vulnerability via commits 59934edbd03c6c1147d75d6c91e96633b710ec31 and 8d43e99c2c01d9aab3ecad00e7a102806262b06b (GitHub Advisory). Users should update to VLC 3.0.24 or later immediately. As a workaround prior to patching, avoid loading .vlt skin files from untrusted or unknown sources, and consider restricting VLC process permissions to limit the impact of potential exploitation (VulnCheck Advisory).