VideoLAN says a VLC security issue shared by CERT-Bund is not as severe as reported and is in a third-party library that was fixed 16+ months ago
and is nothing to do with VLC Graeme Burton / Inquirer : VLC flaw downgraded after VideoLAN claims it was fixed 16 months ago Lawrence Abrams / BleepingComputer : Keep Calm, Carry On. VLC Not Affected by Critical Vulnerability Tweets: @videolan : About the “security issue” on #VLC : VLC is not vulnerable. tl;dr: the issue is in a 3rd party library, called libebml, which was fixed more than 16 months ago. VLC since version 3.0.3 has the correct version shipped, and @MITREcorp did not even check their claim. Thread: Searge / @seargedp : Clickbait beat facts these days. And projects like VLC are suffering the consequences. Also, if institutions like MITRE or CERT do not even verify the reports they put out, how can anybody trust them in the future? https://twitter.com/... Dominic Tarason / @dominictarason : As dramatic as it sounds, it appears that the exploit can only happen if you run a specifically malformed MKV file. So unless you're just downloading sketchy videos from wherever, it should be no worry. https://twitter.com/... @swiftonsecurity : FYI, some things broke down here in how we deal with security flaws, good experience to learn from: https://twitter.com/...
Context & Ripple Effects
A day after CERT-Bund disclosed a serious VLC vulnerability allowing remote code execution, VideoLAN has publicly rejected the finding: it says the flaw lives in the third-party libebml library, was patched more than 16 months ago, and that VLC builds since version 3.0.3 already ship the corrected version. The project also alleges MITRE published the claim without verifying it.
The dispute lands in a coverage cycle dominated by genuine emergencies — Flash's rapid-fire zero-days, Apple's repeated WebKit patches — so an advisory of this severity gets amplified fast before anyone checks whether the affected code is actually shipped. VideoLAN's rebuttal, echoed by BleepingComputer's Lawrence Abrams, turns the story from a patch-now alert into a case study in unverified disclosure.
First-order effects
- VLC users who reacted to the CERT-Bund advisory learn no action is needed on current builds, while anyone tracking the CVE inherits a record VideoLAN says misattributes a fixed libebml bug to the player itself.
- MITRE and CERT-Bund take a direct credibility hit, with VideoLAN alleging the report went out unchecked and commentators like @seargedp framing the episode as clickbait outrunning facts.
Second-order effects
- Downstream consumers of MITRE/CVE data — distro security teams, enterprise scanners, news aggregators — face rework triaging an entry whose severity and attribution are now disputed by the named vendor.
- Other open-source projects gain a template for fast public pushback against advisories they consider wrong, raising the cost for coordinators who publish without confirming which library versions a product actually bundles.
Third-order effects
- If vendor rebuttals like this become routine, vulnerability disclosure pipelines face structural pressure to adopt verification steps — proof-carrying reports that demonstrate the flaw against the shipped artifact — before a CVE earns wide distribution.
- Media incentives around alarming security headlines get a counterweight: outlets that amplified the original claim risk the same credibility erosion as the coordinator, pushing coverage toward vendor-confirmed findings.
The trend: Security disclosure is shifting from coordinator-published advisories taken at face value toward contested claims where vendors publicly audit and rebut findings in real time.