High priorityDisclosed

Advisory · CVE-2026-102875

VLC skin files can escape their folder and drop code

VLC media player before 3.0.24 fails to validate member names in .vlt skin archives, allowing a crafted skin to write arbitrary files and execute code through Lua script injection.

Advisory published September 29, 2026Independent summary
Vendor
VideoLAN
Product
VLC
Identifier / CWE
CVE-2026-102875
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

VLC lets you dress it up with skin files, which are really little zip packages. It unpacks them without checking where the files inside want to go, so a malicious skin can slip a file into a folder it should never reach and smuggle in code that VLC runs.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted skin file

    An attacker builds a .vlt skin archive with member names containing path traversal sequences.

  2. 02Skin loaded

    The victim opens the skin in VLC media player before 3.0.24.

  3. 03Unvalidated extraction

    The skins2 ThemeLoader extracts members without validating names (CWE-22).

  4. 04File write and Lua execution

    Files land outside the skin directory, enabling code execution through injected Lua scripts.

What happened

A path traversal vulnerability was disclosed in VLC media player before 3.0.24. The skins2 ThemeLoader does not validate member names inside .vlt skin archives, so a crafted skin can write arbitrary files with the privileges of the VLC user and enable code execution through Lua script injection. It carries a CVSS 4.0 score of 8.5 (high).

What to do

  1. Upgrade VLC to 3.0.24 or later on all managed endpoints.
  2. Do not open skin files from untrusted sources, and block .vlt downloads through content policies where feasible.
  3. Check endpoints for recently added .vlt files and for unexpected writes in user-writable directories around the time skins were loaded.
  4. Review Lua script and startup locations for signs of injected scripts.

Management note

VLC is on a huge share of desktops, and skin files look harmless, which is exactly what makes this an effective social-engineering carrier. The fix is a version bump, but the exposure window depends on how fast fleet updates roll out.