CVE-2008-4654: Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC...

Security readout for executives and security teams

CVE-2008-4654 is an old VLC Media Player flaw where a malicious TiVo TY media file could corrupt memory when opened. Successful exploitation could let an attacker run code on the affected machine. The source bundle names VLC 0.9.0 through 0.9.4 as affected, with no evidence of current active exploitation. Exposure is mainly legacy desktops, kiosks, or media-processing systems still running VLC 0.9.0 through 0.9.4 and opening untrusted TiVo TY files. Modern supported VLC deployments are less likely exposed, but the bundle provides no CPE inventory or downstream package mapping. Treat this as high priority only where legacy VLC versions remain in use. The business risk is workstation or media-system compromise through malicious media files. For current, managed environments, priority is usually inventory confirmation and cleanup rather than emergency response. Mitigation focus: Inventory VLC installations and remove versions 0.9.0 through 0.9.4.; Upgrade affected VLC installations using VideoLAN or operating-system vendor guidance.; Restrict opening untrusted TiVo TY media files on legacy systems..

Prepared

Jun 28, 2026, 11:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.