VLC media player

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. VLC sits in Tier 2, which caps at $5,000; the $15,000 headline is the Tier 1 column and is not reachable here. Memory-safety hardening can carry a 2× or 3× multiplier. Patches must be between one and twelve months old, submissions are rate-limited to three a month, and sanctions and territory exclusions apply. CVE history 2 Last 12 months 124 Lifetime Memory safety 55 % Parsing/validation 20 % Code execution 15 % Denial of service 8 % Latest advisories Loading the feed Overview VLC is the default open-anything media player on Windows, macOS, Linux, Android, iOS and a long tail of embedded and set-top platforms. Its job is to open files people pulled off the internet without thinking about it, and libVLC puts the same demuxers inside other applications, so the blast radius runs well past the desktop app. With 124 lifetime CVEs it has one of the heaviest records of any desktop application here, and the drop to two last year is what a decade of sustained fuzzing looks like: the easy bugs are gone and the rest are worth more. VideoLAN pays nothing for a report, so sorona.xyz pays you directly on qualified, reproduced findings. In scope VideoLAN takes security reports at [email protected] , the address OSS-Fuzz also lists as the project's primary contact. The covered artefact is the upstream VLC tree and libVLC, rather than forks, repackagings or VideoLAN's web properties The whole demux and mux layer, covering MP4, MKV, AVI, TS, Ogg, ASF and the long tail of formats behind them. Historically the richest bug source in the codebase Every decoder module and the codec integration layer that hands parsed frames across into them The subtitle parsers as a set, SSA and ASS, SRT and WebVTT included. A repeat offender, because a subtitle file arrives as plain text nobody inspects The access and stream-input modules in full: HTTP, RTSP, HLS, SMB and every other network path where the untrusted bytes arrive without a file ever being saved The libVLC embedding API used by third-party applications, which exposes the same parsers inside other software Out of scope Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail Bugs in third-party system codecs that VideoLAN does not vendor VideoLAN's web properties and download infrastructure, which are not the covered artefact Crashes with no demonstrated security impact Third-party VLC forks and mobile repackagings rather than the upstream repository Patches outside the one-to-twelve-month age window the program requires Most-valued findings Memory corruption in a demuxer reached by opening a single crafted media file. That is 55% of VLC's bug history and the shape that turns a double-click into code execution Code execution driven by a subtitle file, which victims treat as inert text and which loads automatically alongside a video Heap corruption in a network or streaming input module, where a hostile HLS or RTSP source never needs the user to save a file at all Defects reachable through the libVLC embedding API, since they inherit every application that embeds VLC's parsers rather than affecting the player alone Structural hardening of a demuxer or codec integration path that closes a class of bounds errors at once, which is the shape the top of Google's ladder is written for Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. The cash on Google's rail is paid for a merged upstream patch rather than for a vulnerability report; a report on its own earns nothing there Keep the patch merged, without reverts, for one month before claiming, and submit it while it is between one and twelve months old Three Patch Rewards submissions per person per month is the hard cap The European Commission's VLC program on HackerOne is paused rather than closed; a resumption is possible but must not be assumed when you plan a submission Google cannot pay individuals or entities on sanctions lists, in sanctioned territories, or located in Russia or Belarus Disclosure Coordinated with the VideoLAN security team through [email protected] , which is the same address OSS-Fuzz lists as the project's primary contact. VideoLAN publishes its own advisories with researcher credit; hold the sample and the write-up until a fixed release is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability