Recently, the multimedia player VLC 3.0.24 was introduced with a release. The code for VLC is written in C and is distributed under the LGPLv2.1 license. One of the main highlights of this release is the fixing of more than 130 security issues in VLC and its built-in libraries. These issues include problems related to buffer overflows, read-after-frees, integer overflows, and double frees. The details of these security fixes have not been disclosed yet, but it is known that some of these vulnerabilities could be exploited when processing specially designed content.
Aside from security fixes, some notable changes have been made in VLC 3.0.24. These include:
- Added support for decoding Atrac3 and Atrac9 audio formats.
- Introduction of a decoder for the APV format.
- Added support for CEA-708 subtitles in the MP4 multimedia container.
- Now supports ID3v2 metadata in the MPEG media container unpacker.
- Implemented the ability to capture video in NV12 format using the DirectShow API on Windows.
- Improved the implementation of the SRT protocol to support listener mode for receiving connection requests.
- Enhanced logic for determining subtitle language based on file names and SSA/ASS metadata.
- Added support for accessing content via the SFTP protocol using public key authentication.
- Improved definitions of SMB2 network partitions.
- Now supports building a package in the Flatpak format.
- NPAPI and youtube.lua plugins have been removed, and the RealRTSP plugin build is now disabled by default.
- Transitioned to using the new RSA-4096 key to verify updates.
- Updated 49 third-party libraries, with the FFmpeg package upgraded from version 4.4 to 8.1.2.
/Reports, release notes, official announcements.