From gitlab at videolan.org  Thu Oct  1 12:08:40 2026
From: gitlab at videolan.org (Thomas Guillem (@tguillem))
Date: Thu, 01 Oct 2026 14:08:40 +0200
Subject: [www-doc] [Git][VideoLAN.org/websites] Pushed new branch
 sec-bulletin-24
Message-ID: <6abe4d4864fb3_14fd4398142101301559@gitlab.mail>



Thomas Guillem pushed new branch sec-bulletin-24 at VideoLAN organization / websites

-- 
View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/tree/sec-bulletin-24
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help



From gitlab at videolan.org  Thu Oct  1 12:10:17 2026
From: gitlab at videolan.org (Thomas Guillem (@tguillem))
Date: Thu, 01 Oct 2026 14:10:17 +0200
Subject: [www-doc] [Git][VideoLAN.org/websites][master] Add VLC 3.0.24
 Security Bulletin
Message-ID: <6abe4da9a4407_14fd4391d071413022ab@gitlab.mail>



Thomas Guillem pushed to branch master at VideoLAN organization / websites


Commits:
d7b11940 by Thomas Guillem at 2026-10-01T14:08:25+02:00
Add VLC 3.0.24 Security Bulletin

- - - - -


2 changed files:

- www.videolan.org/security/index.php
- + www.videolan.org/security/sb-vlc3024.php


Changes:

=====================================
www.videolan.org/security/index.php
=====================================
@@ -19,6 +19,13 @@
     <div class="col-md-6">
         <h2>VLC releases Security Bulletins <em>(SB)</em></h2>
            <p>Those bulletins are related to each VLC release and can be made of multiple security issues, internal and external.</p>
+           <h3>2026</h3>
+           <dl>
+           <dt>VideoLAN-SB-VLC-324</dt>
+           <dd>Multiple vulnerabilities fixed in VLC media player 3.0.24
+            <a href="sb-vlc3024.html">Details</a>
+           </dd>
+           </dl>
            <h3>2025</h3>
            <dl>
            <dt>VideoLAN-SB-VLC-322</dt>


=====================================
www.videolan.org/security/sb-vlc3024.php
=====================================
@@ -0,0 +1,103 @@
+<?php
+   $title = "VideoLAN Security Bulletin VLC 3.0.24";
+   $lang = "en";
+   $menu = array( "vlc" );
+   $body_color = "red";
+   require($_SERVER["DOCUMENT_ROOT"]."/include/header.php");
+?>
+
+
+<div id="fullwidth">
+
+<h1>Security Bulletin VLC 3.0.24</h1>
+
+<pre>
+Summary           : Multiple vulnerabilities addressed in VLC media player 3.0.24
+Date              : September 2026
+Affected versions : VLC media player 3.0.23 and earlier
+ID                : VideoLAN-SB-VLC-3024
+CVE references    : CVE-2026-56711, CVE-2026-73324
+</pre>
+
+<h2>Details</h2>
+<p>
+    VLC 3.0.24 fixes over 50 security issues in VLC itself. It also updates many bundled libraries, including FFmpeg, GnuTLS, libxml2 and libpng;
+    these updates include fixes for at least 74 publicly documented vulnerabilities.
+</p>
+
+<p>Higher-impact issues:</p>
+<ul>
+    <li>Heap buffer overflows in the TagLib metadata adapter when reading crafted media. (#30094)</li>
+    <li>Integer overflows in picture allocation, leading to heap buffer overflows when processing images or subtitles. (#29692)</li>
+    <li>A heap buffer overflow in WiDi LPCM audio decoding. (#29663)</li>
+    <li>Out-of-bounds reads and writes when processing ARIB logo data in MPEG transport streams. (#29957)</li>
+    <li>An integer overflow leading to a heap buffer overflow when reading metadata from a crafted VDR recording. (#29806)</li>
+    <li>A path traversal when extracting a crafted skin archive, and a heap buffer overflow when loading a crafted skin.</li>
+    <li>Disclosure of process memory to a SAT&gt;IP server during session teardown. (#30072)</li>
+    <li>Memory-safety issues in the legacy RealRTSP plugin, addressed by disabling the plugin in packaged builds. (#29956)</li>
+</ul>
+
+<p>Additional fixes addressed:</p>
+<ul>
+    <li>Buffer overflows and invalid memory accesses in Speex, ADPCM, G.711 and AAC decoding, and in FFmpeg audio channel handling.</li>
+    <li>Invalid memory accesses in CEA-608 and CEA-708 captions, and DVD and CVD subtitles.</li>
+    <li>Out-of-bounds accesses, a use-after-free and malformed-input handling in Matroska, Ogg, AVI, MP4, MPEG-TS, TiVo TY and image demuxers, and in MMS, Smooth Streaming and RIST handling.</li>
+    <li>Disclosure of uninitialised memory in ASF and MPEG-TS stream output and raw-video RTP packets.</li>
+    <li>Invalid memory accesses in CD-ROM and CUE sheet handling, and allocation overflows in OMX IL and JPEG/PNG encoding.</li>
+    <li>FTP command injection through crafted URLs. (#30078)</li>
+</ul>
+
+<h2>Impact</h2>
+<p>These issues may cause crashes and memory disclosure with the user's privileges. Code execution has been demonstrated on macOS under specific conditions.</p>
+
+<h2>Threat mitigation</h2>
+<p>
+    Crafted files or streams can trigger these issues during opening, metadata preparsing, or playlist processing.
+    Network and stream-output issues require the affected features to be in use.
+</p>
+
+<h2>Workarounds</h2>
+<p>Users who cannot upgrade yet should refrain from opening files or streams from untrusted sources.</p>
+
+<h2>Solution</h2>
+<p>Upgrade to VLC media player <b>3.0.24</b>.</p>
+<p>Distributors should apply the bundled-library updates or equivalent patches and keep RealRTSP disabled.</p>
+
+<h2>Support</h2>
+<p>VideoLAN thanks the <a href="https://www.sovereign.tech/">Sovereign Tech Agency</a>, and especially its Sovereign Tech Fund program, for supporting VLC's sustainability and safety.</p>
+
+<h2>Credits</h2>
+<ul>
+    <li>Thomas Guillem for finding issues in audio decoding, subtitles, demuxers, network input and stream output. (#29663, #29671, #29681, #29692, #29694, #29696, #29710, #29711, #30060, #30083, #30084, #30086)</li>
+    <li>Fabian Wahle (Hap Security) for the SAT&gt;IP disclosure and additional image-processing, RealRTSP and skin findings. (#30072, #29692, #29956, #29929; CVE-2026-56711, CVE-2026-73324)</li>
+    <li>tedanvosin for the TagLib adapter report and additional ARIB logo impact analysis. (#30094, #29957)</li>
+    <li>Kai Martin (KG3N Dynamics) for the ARIB logo and RealRTSP reports. (#29957, #29956)</li>
+    <li>Khoka Moni for the VDR report. (#29806)</li>
+    <li>Fran?ois Cartegnie for the Speex, CVD subtitle and CD-ROM findings. (#30103, #29864, #29863, #29862, #29859, #29858, #29857, #29856)</li>
+    <li>tianshuo han for the TiVo TY, Matroska DVD menu, Ogg header handling and CEA-708 reports. (#29773, #29772, #29751, #29750)</li>
+    <li>HE WEI (???) for the AVI subtitle, IMA/QuickTime ADPCM and G.711 reports. (#29972, #29971, #29969)</li>
+    <li>Asif Nadaf for the Ogg Annodex, DVD SPU and TiVo TY reports. (#30045, #30046, #30044)</li>
+    <li>Tristan Madani for the Ogg Skeleton and TiVo TY reports. (#29959, #29958)</li>
+    <li>Brinly for the JPEG/PNG encoding and OMX IL reports. (#29720, #29719)</li>
+    <li>Keno Hassler for the AAC channel-count report. (#30073)</li>
+    <li>oxsignal for the MP4 CEA-608 report. (#29884)</li>
+    <li>Alexandru Hossu for the Smooth Streaming report. (#29801)</li>
+    <li>Aryan Chehreghani for the MMS report. (#29987)</li>
+    <li>Trail of Bits for the cryptographic dependency report. (#29760)</li>
+    <li>Cisco Talos for reporting the outdated FFmpeg dependency. (#29732)</li>
+    <li>Mohammadmobinjavan (Ma3terPwner) and Adel Piri for the FTP command-injection report. (#30078)</li>
+    <li>The upstream library maintainers and the VideoLAN contributors for their testing, reports and fixes.</li>
+    <li>OSS-Fuzz for continuous fuzzing and issue reports throughout the release cycle. (#30080, #30037, #30024, #29954, #29895, #29893, #29887, #29879, #29852, #29837, #29835, #29834, #29832, #29831, #29822, #29808, #29807, #29800, #29781, #29776, #29756, #29728, #29686, #29677, #29670, #29657, #29636, #29634, #29578, #29565, #29561, #29560, #29546, #29541, #29521, #29518, #29517, #29449, #29446, #29444, #29321, #29289, #29227, #29223, #29057, #29001, #28991)</li>
+</ul>
+
+<h2>References</h2>
+<dl>
+    <dt>The VideoLAN project</dt>
+    <dd><a href="//www.videolan.org/">https://www.videolan.org/</a></dd>
+    <dt>VLC official Git repository</dt>
+    <dd><a href="https://code.videolan.org/videolan/vlc.git">https://code.videolan.org/videolan/vlc.git</a></dd>
+</dl>
+
+</div>
+
+<?php footer('$Id$'); ?>



View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/d7b119405b1db751ae1860057ed2a4c30d7ff638

-- 
View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/d7b119405b1db751ae1860057ed2a4c30d7ff638
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help



From gitlab at videolan.org  Tue Oct  6 11:59:33 2026
From: gitlab at videolan.org (Vibhoothi (@mindfreeze))
Date: Tue, 06 Oct 2026 13:59:33 +0200
Subject: [www-doc] [Git][VideoLAN.org/websites][master] vdd26: Update
 schedule
Message-ID: <6ac4e2a53d4aa_14fd4310a76d442169370@gitlab.mail>



Vibhoothi pushed to branch master at VideoLAN organization / websites


Commits:
7457b646 by vibhoothi at 2026-10-06T12:58:48+01:00
vdd26: Update schedule

- - - - -


1 changed file:

- www.videolan.org/videolan/events/vdd26/index.php


Changes:

=====================================
www.videolan.org/videolan/events/vdd26/index.php
=====================================
@@ -442,7 +442,7 @@
                 <div class="event event-talk">
                   <h4 class="event-time">12:10 - 12:25</h4>
                   <div class="event-description">
-                    <h3>Handling VLC Security Issues with Claudex, with a RCE case study</h3>
+                    <h3>Handling VLC Security Issues with LLMs, Including an RCE Case Study</h3>
                     <p class="event-author">Thomas Guillem <span class="event-affil">(VideoLAN)</span></p>
                     <details class="event-details">
                       <summary>Abstract &amp; speaker</summary>
@@ -664,8 +664,16 @@
                 <div class="event event-talk">
                   <h4 class="event-time">11:35 - 11:55</h4>
                   <div class="event-description">
-                    <h3>TBD</h3>
-                    <p class="event-author">TBD</p>
+                    <h3>Extending GDB for Multimedia Developers</h3>
+                    <p class="event-author">Alexandra Petlanova Hajkova</p>
+                    <details class="event-details">
+                      <summary>Abstract &amp; speaker</summary>
+                      <div class="event-details-body">
+                        <p>I'm going to show my improvements to GDB. First, I'll demonstrate how to run Valgrind from inside GDB which makes Valgrind interactive instead of the static tool. Next, I'll introduce source-tracking breakpoints, an experimental tool I'm currently trying to add to GDB, which use saved source context to follow code changes after editing and rebuilding to adjust the breakpoints automatically. And finally, I'll be showing two experimental GDB Python commands that bring kernel information into a debugging session. drgn_why_sleeping uses drgn to inspect a thread's kernel stack and help understand what it is waiting for. ftrace-next records kernel function calls and return values while stepping over source code. I'll explain the current capabilities and limitations of my experiments.</p>
+                        <h5>About the speaker</h5>
+                        <p>I am currently working at Red Hat, in the Linux kernel debugging team after several years developing GDB and Valgrind. My open-source background includes contributions to x264 and libvpx, I was working on SIMD optimizations for video codecs. My debugging work includes closer GDB?Valgrind integration, source-tracking breakpoints, and recent experiments connecting GDB with drgn and ftrace.</p>
+                      </div>
+                    </details>
                   </div>
                 </div>
                 <div class="event event-talk">



View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/7457b6461ab8b1ed1355faaa120e3b41b3d45fd0

-- 
View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/7457b6461ab8b1ed1355faaa120e3b41b3d45fd0
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help



From gitlab at videolan.org  Wed Oct  7 10:08:14 2026
From: gitlab at videolan.org (Vibhoothi (@mindfreeze))
Date: Wed, 07 Oct 2026 12:08:14 +0200
Subject: [www-doc] [Git][VideoLAN.org/websites][master] vdd26: Add another
 talk to AI session, and classrooms
Message-ID: <6ac61a0ed7c72_14fd43122d131c230786f@gitlab.mail>



Vibhoothi pushed to branch master at VideoLAN organization / websites


Commits:
5acac032 by vibhoothi at 2026-10-07T11:07:31+01:00
vdd26: Add another talk to AI session, and classrooms

- - - - -


1 changed file:

- www.videolan.org/videolan/events/vdd26/index.php


Changes:

=====================================
www.videolan.org/videolan/events/vdd26/index.php
=====================================
@@ -400,8 +400,17 @@
                 <div class="event event-talk">
                   <h4 class="event-time">11:25 - 11:40</h4>
                   <div class="event-description">
-                    <h3>TBD</h3>
-                    <p class="event-author">TBD</p>
+                    <h3>An AV1 Encoder in a Day: What Spec-Driven Agentic Coding Can Actually Do</h3>
+                    <p class="event-author">Rafael Caricio <span class="event-affil">(Netflix)</span></p>
+                    <details class="event-details">
+                      <summary>Abstract &amp; speaker</summary>
+                      <div class="event-details-body">
+                        <p>Writing a video encoder usually takes months, not hours. In under twelve hours, I used Claude Code to build wav1c: a bare-bones spec-compliant AV1 encoder in pure Rust, with no dependencies. It decodes with dav1d and Apple's hardware decoder, plugs into FFmpeg, and runs in real time in the browser via WebAssembly.</p>
+                        <p>This talk is an honest account of how a former AI skeptic got there. It covers why standards documents plus an encode/decode verification loop suits agentic coding so well, where the agent needed steering, and what lower-cost custom codecs could mean for multimedia. You'll leave with practical patterns for using coding agents on complex, spec-driven work.</p>
+                        <h5>About the speaker</h5>
+                        <p>Rafael Caricio is a Senior Software Engineer at Netflix with a long-running interest in multimedia technology, Rust, and open source.</p>
+                      </div>
+                    </details>
                   </div>
                 </div>
                 <div class="event event-talk">
@@ -480,7 +489,7 @@
             <div class="event event-talk">
               <h4 class="event-time">12:35 - 12:55</h4>
               <div class="event-description">
-                <h3>Community Day</h3>
+                <h3>Community Day Updates and Results</h3>
                 <p class="event-author">Jean-Baptiste Kempf <span class="event-affil">(VideoLAN)</span></p>
               </div>
             </div>
@@ -495,10 +504,11 @@
               <div class="event-description">
                 <h3>Meetups session 1/2</h3>
                 <div class="event-rooms">
-                  <div class="event-room"><span>Room 1</span>VLC media player</div>
-                  <div class="event-room"><span>Room 2</span>AV2 Developer Room</div>
-                  <div class="event-room"><span>Room 3</span>Unconferences</div>
+                  <div class="event-room"><span>Aula Alfa</span>VLC media player</div>
+                  <div class="event-room"><span>Aula Portico</span>AV2 Developer Room</div>
+                  <div class="event-room"><span>Aula Oriana</span>Unconferences</div>
                 </div>
+                <p class="event-author">All located on the ground floor.</p>
               </div>
             </div>
             <div class="event event-meetups">
@@ -506,10 +516,11 @@
               <div class="event-description">
                 <h3>Meetups session 2/2</h3>
                 <div class="event-rooms">
-                  <div class="event-room"><span>Room 1</span>TBD</div>
-                  <div class="event-room"><span>Room 2</span>FFmpeg</div>
-                  <div class="event-room"><span>Room 3</span>Unconferences</div>
+                  <div class="event-room"><span>Aula Alfa</span>TBD</div>
+                  <div class="event-room"><span>Aula Portico</span>FFmpeg</div>
+                  <div class="event-room"><span>Aula Oriana</span>Unconferences</div>
                 </div>
+                <p class="event-author">All located on the ground floor.</p>
               </div>
             </div>
             <div class="event event-lunch">
@@ -714,9 +725,9 @@
               <div class="event-description">
                 <h3>Unconferences</h3>
                 <div class="event-rooms">
-                  <div class="event-room"><span>Room 1</span></div>
-                  <div class="event-room"><span>Room 2</span></div>
-                  <div class="event-room"><span>Room 3</span></div>
+                  <div class="event-room"><span>Aula Alfa</span></div>
+                  <div class="event-room"><span>Aula Portico</span></div>
+                  <div class="event-room"><span>Aula Oriana</span></div>
                 </div>
               </div>
             </div>
@@ -792,6 +803,7 @@
           <h3 class="text-center uppercase">Conference</h3>
           <h4><a href="https://www.uniroma1.it/en/pagina/sapienza-conference-centre" target="_new">Sapienza Conference Centre, Sapienza University of Rome</a></h4>
           <p>Via Salaria 113, 00198 Roma, Italy</p>
+          <p>Meetups and unconferences will take place in Aula Alfa, Aula Portico and Aula Oriana, all located on the ground floor. You are also allowed to hangout in the outdoor courtyards!</p>
           <iframe width="75%" height="200" src="https://www.openstreetmap.org/export/embed.html?bbox=12.49369%2C41.91317%2C12.50055%2C41.91527&amp;layer=mapnik&amp;marker=41.91422%2C12.49712" style="border: none"></iframe><br/><small><a href="https://www.openstreetmap.org/?mlat=41.91422&amp;mlon=12.49712#map=17/41.91422/12.49712">View Larger Map</a></small>
       </div>
       <div class="col-md-6">



View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/5acac032b6fb914a29df646dfc6c2c4e795a1fde

-- 
View it on GitLab: https://code.videolan.org/VideoLAN.org/websites/-/commit/5acac032b6fb914a29df646dfc6c2c4e795a1fde
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help