VLC releases major 3.0.24 update with 130+ security fixes

VideoLAN has released VLC version 3.0.24, marking the largest security update in the history of the open-source media player. The update addresses more than 130 vulnerabilities, including out-of-bounds reads/writes, integer overflows, and use-after-free issues within the player and its included libraries.

Jean-Baptiste Kempf, president of VideoLAN, noted that the scale of this update surpasses the previous record set in 2019. The increased efficiency in identifying these bugs is attributed in part to the growing use of Large Language Models (LLMs) for code analysis.

Beyond security, version 3.0.24 introduces several functional improvements. It includes support for FFmpeg 8.1.2, enabling the decoding of the Advanced Professional Video (APV) codec used by Samsung devices, as well as Sony’s proprietary ATRAC3 and ATRAC9 audio codecs. Other updates include support for CEA-708 closed captions in MP4, improved SFTP support with ED25519 hostkey support, and enhanced RIST input/output capabilities.