Debasish Mandal

The issue is related to the improper handling of objects in memory, which can allow a remote attacker to execute arbitrary code by using a specially crafted file. If the current user is logged on with administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights.

The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read. When parsing a specially crafted ASF movie, a buffer overflow might occur, leading to a crash of VLC media player's process. In some cases, attackers might exploit this issue to execute arbitrary code within the context of the application.

A stack-based buffer overflow issue allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the `ref href` tag. This issue exists due to a regression.