CVE-2011-0522: VLC Media Player subtitle parser heap corruption via malformed tag

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution via a crafted media file with public exploit code and very high EPSS, though it requires user interaction and affects only older VLC 1.1 builds.

What it is

The StripTags function in VLC Media Player's USF and Text subtitle decoders mishandles a subtitle containing an opening "<" with no closing ">", causing heap memory corruption. Because the flaw is reachable from a crafted MKV subtitle file, it matters to anyone who opens untrusted media in the affected 1.1 releases before 1.1.6-rc.

Impact

An attacker can corrupt heap memory and execute arbitrary code in the context of the user running VLC. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

Reached by opening a malicious MKV file containing a crafted subtitle; no authentication is required, but the victim must open or play the file, so some user interaction is implied. The vector is network-reachable (AV:N) with medium access complexity.

Exploitation

Public exploit code exists in Exploit-DB and SecurityFocus references, and EPSS is 0.51538 (98.9th percentile), indicating elevated likelihood. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded.

What to do

• Upgrade VLC Media Player to 1.1.6-rc or later, which contains the StripTags fix.
• If upgrading is not possible, avoid opening untrusted MKV or subtitle files with affected VLC 1.1 versions.
• Apply the vendor patch referenced in the VideoLAN development mailing list and git commit.
• Restrict or sandbox media player execution where untrusted media is routinely handled.

Detection

• Monitor for VLC crashes or abnormal process termination when opening MKV files, which may indicate heap corruption attempts.
• Scan media libraries and email attachments for MKV files with malformed subtitle tags (unclosed "<") before playback.
• Correlate endpoint telemetry for VLC spawning unexpected child processes or network connections after media playback.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.