CVE-2010-3275: VLC Media Player AMV Parsing Dangling Pointer Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with complete impact and public exploit code plus very high EPSS, though not confirmed in KEV and requiring user interaction.

What it is

VLC Media Player before 1.1.8 contains a dangling pointer flaw in libdirectx_plugin.dll that is triggered by a crafted width value in an AMV file. Successful exploitation allows remote code execution on the affected system. The issue is a memory corruption class bug (CWE-119) in a widely deployed media player.

Impact

An attacker can execute arbitrary code with the privileges of the user running VLC, leading to full compromise of the host. Because the CVSS vector shows complete confidentiality, integrity, and availability impact, the outcome is total loss of control over the affected process and data.

Attack surface

The flaw is reached remotely over the network (AV:N) when a victim opens or plays a malicious AMV file, requiring no authentication (Au:N) but some user interaction such as opening the file or visiting a page that loads it (AC:M). The vulnerable code path is in the DirectX plugin used for AMV playback.

Exploitation

Public exploit code exists in Exploit-DB and a Metasploit module, and EPSS is very high at 0.755 (99.5th percentile), indicating active interest. The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in that dataset.

What to do

• Upgrade VLC Media Player to version 1.1.8 or later, which contains the vendor patch.
• If immediate upgrade is not possible, restrict or disable playback of untrusted AMV files and block AMV content at email and web gateways.
• Apply the Debian security update DSA-2211 where applicable.
• Run VLC with least privilege and avoid opening media files from untrusted sources.
• Monitor vendor advisories for any further updates to the DirectX/AMV parsing code.

Detection

• Hunt for VLC processes spawning child processes or making unexpected network connections after opening media files.
• Monitor for AMV files with abnormal width fields or malformed headers entering the environment via email or web downloads.
• Use endpoint detection to flag crashes or memory corruption events in libdirectx_plugin.dll.
• Review proxy and IDS logs for known exploit delivery patterns associated with the public Metasploit module.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.