A flaw was found in VLC media player. An attacker can achieve arbitrary code execution by convincing a user to open a maliciously crafted skin archive. Because the theme loader fails to properly validate member file paths within the archive, files containing directory traversal sequences can be written to arbitrary locations with the privileges of the running application.
Last checked: 2026-09-30 19:21 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 13:50 UTC)
Fix evidence last checked: 2026-09-30 19:26 UTC
Debian 13 (Trixie)
DSA-6515-1 · Published 2026-09-25