CVE-2014-9626: Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media pl...

Security readout for executives and security teams

CVE-2014-9626 affects VideoLAN VLC media player before 2.1.6. A specially malformed MP4 structure can trigger an integer underflow while VLC parses the file, causing a denial of service and possibly other unspecified impact. The sources do not provide a CVSS score or evidence of active exploitation. Exposure is most likely on endpoints or systems that still use VLC media player before 2.1.6 to open MP4 content. Organizations with managed desktops, shared media workstations, or legacy packaged VLC builds should verify versions. Treat this as a legacy exposure cleanup item, not an emergency based on available evidence. Prioritize remediation where outdated VLC is broadly deployed or used to process untrusted media. Mitigation focus: Upgrade VLC installations to version 2.1.6 or later.; Remove or restrict legacy VLC builds from managed endpoints.; Check VideoLAN advisory guidance before applying compensating controls..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.