Is CVE-2013-3245 actively exploited?

No active exploitation of CVE-2013-3245 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2013-3245 be exploited remotely?

Yes. CVE-2013-3245 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2013-3245?

CVE-2013-3245 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2013-3245

MEDIUM

CVE-2013-3245

CWE-119Published: July 10, 2013· Updated: Jun 16, 2026

6.3

CVSS v3.1

Official Description

plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MKV file, possibly involving an integer overflow and out-of-bounds read or heap-based buffer overflow, or an uncaught exception. NOTE: the vendor disputes the severity and claimed vulnerability type of this issue, stating "This PoC crashes VLC, indeed, but does nothing more... this is not an integer overflow error, but an uncaught exception and I doubt that it is exploitable. This uncaught exception makes VLC abort, not execute random code, on my Linux 64bits machine." A PoC posted by the original researcher shows signs of an attacker-controlled out-of-bounds read, but the affected instruction does not involve a register that directly influences control flow

NVD Source

Technical Analysis

CVE-2013-3245 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.