CVE-2026-102875 in VLC
Summary
by MITRE • 09/29/2026
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in versions of VLC media player prior to 3.0.24 represents a critical security flaw within the skins2 subsystem, specifically affecting the ThemeLoader component responsible for parsing and applying visual themes packaged as .vlt archives. This archive format is essentially a compressed container that holds various resource files defining the user interface appearance. The core technical deficiency lies in the failure of the application to perform rigorous validation on member names contained within these archives before extraction or processing. When a user loads a maliciously crafted skin file, the parser does not adequately sanitize path traversal sequences such as dot-dot-slash characters embedded in the filenames of internal resources. This lack of input sanitization allows an attacker to manipulate the destination paths during the archive extraction process, effectively bypassing intended directory boundaries and writing files outside the designated theme folder structure.
The operational impact of this flaw is severe because it directly compromises the integrity of the local file system under the context of the currently logged-in user. By exploiting the path traversal mechanism, an attacker can overwrite or create arbitrary files in sensitive directories accessible to that user account. The most dangerous consequence arises from VLC's support for Lua scripting, which allows skins and plugins to extend functionality through executable code. If an attacker successfully writes a malicious Lua script into a location where it is automatically loaded by the player upon startup or theme application, they achieve remote code execution with the privileges of the victim user. This transforms what might initially appear as a simple UI customization feature into a potent vector for arbitrary command execution, data theft, or further lateral movement within an affected system.
From a classification perspective, this vulnerability aligns closely with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation technique involves crafting specific input that manipulates the file system interface, allowing access to resources outside the restricted directory where they should not be accessible. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior maps to techniques involving File and Directory Discovery followed by Command and Scripting Interpreter execution via Lua scripts. The attack vector typically requires user interaction, specifically the act of opening or importing a malicious skin file, which places it in the category of social engineering dependent vectors where trust is abused through seemingly benign media assets.
Mitigation strategies for this vulnerability primarily involve upgrading VLC media player to version 3.0.24 or later, where the skins2 ThemeLoader has been patched to enforce strict validation on archive member names and restrict file operations to safe directories. For environments where immediate patching is not feasible, administrators should implement application whitelisting policies that prevent unauthorized Lua scripts from executing within VLC processes. Additionally, users are advised to exercise caution when downloading skin files or themes from untrusted sources, ensuring they originate from official repositories or verified developers. Security monitoring solutions can also be configured to detect unusual file creation patterns in directories associated with media player configurations, providing an additional layer of defense against exploitation attempts targeting this specific weakness.