mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4507 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4507-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     March 23, 2026                              https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : vlc     Version        : 3.0.23-0+deb11u1     CVE ID         : CVE-2025-51602

    An out-of-bounds read vulnerability was discovered in VLC media player,     a multimedia player and streamer. The MMS protocol handler in mmstu.c     did not properly validate boundaries when processing a crafted 0x01     response from an MMS server. A remote attacker controlling a malicious     MMS server could exploit this to cause an out-of-bounds read, resulting     in a denial of service (application crash) and potentially leaking     sensitive memory contents.

    For Debian 11 bullseye, this problem has been fixed in version     3.0.23-0+deb11u1.

    We recommend that you upgrade your vlc packages.

    For the detailed security status of vlc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/vlc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VLC media player installed on the remote host is prior to 3.0.22. It is, therefore, affected by multiple vulnerabilities. If successful, a malicious third party could trigger a crash of VLC (Denial of service). While these issues in themselves are most likely to just crash the application, we can't exclude that they could be combined to leak user information or remotely execute code. ASLR and DEP help reduce the likeliness of code execution, but may be bypassed.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via     a crafted 0x01 response from an MMS server. (CVE-2025-51602)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
303381	Debian dla-4507 : libvlc-bin - security update	Nessus	Debian Local Security Checks	Local	medium
283730	VLC < 3.0.22 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
282520	Linux Distros Unpatched Vulnerability : CVE-2025-51602	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-51602

medium

Tenable Plugins

medium

medium

medium