CVE-2008-4654

Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

57.55% chance of exploitation in the next 30 days, 99th percentile

Published

2008-10-21

Updated

2024-08-07

Proof-of-concept exploits (4)

• Hexastrike/CVE-2008-46540★ · 2025-02-20
• KernelErr/VLC-CVE-2008-4654-Exploit2★ · 2017-08-18
• bongbongco/CVE-2008-46540★ · 2017-07-02
• rnnsz/CVE-2008-46540★ · 2021-05-31

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/videolan_tivo…

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/16629
• https://www.exploit-db.com/exploits/6825
• https://www.exploit-db.com/exploits/6798

References

• CVE Record
• NVD entry

Related

• CVE-2025-0282
• CVE-2012-1675
• CVE-2012-6066
• CVE-2015-1635
• CVE-2017-5638
• CVE-2017-15950