CVE-2008-4654: VLC Media Player TY demux plugin stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit reference and very high EPSS score, though it requires user interaction and affects an old VLC version.

What it is

The parse_master function in VLC Media Player's Ty demux plugin (modules/demux/ty.c) has a stack-based buffer overflow triggered by a crafted size value in the header of a TiVo TY media file. VLC 0.9.0 through 0.9.4 are affected, and a successful overflow can lead to arbitrary code execution.

Impact

An attacker who gets a victim to open a malicious TY file can execute arbitrary code with the privileges of the VLC process, giving full compromise of confidentiality, integrity and availability.

Attack surface

Reached remotely by supplying a crafted TiVo TY media file that the user opens in VLC; no authentication is required, but the CVSS vector (AV:N/AC:M/Au:N) indicates some user interaction or a non-trivial condition is needed to trigger parsing.

Exploitation

Not listed in CISA KEV, but EPSS is 0.575 (99th percentile) and a public exploit reference (TKADV2008-010) exists, so exploitation is plausible and tooling may be available.

What to do

• Upgrade VLC Media Player to a version newer than 0.9.4 that contains the fix in modules/demux/ty.c (see vendor advisory sa0809 and the referenced git commits).
• If upgrade is not immediately possible, disable or avoid opening untrusted TiVo TY files in VLC.
• Apply the vendor patch or distribution update for VLC on all endpoints where it is installed.
• Restrict execution of VLC to trusted media sources and consider application allowlisting for media players.

Detection

• Monitor for VLC processes crashing or spawning unexpected child processes after opening TY files.
• Search endpoint logs for VLC opening files with .ty extensions from untrusted or external sources.
• Use file inspection or sandboxing to flag TY files with anomalous header size values before they reach VLC.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.