VLC media player EUVD-2026-89410

Requires the victim to be running the skins2 interface (a non-default VLC UI module; the default is Qt) AND to open an attacker-crafted malicious .vlt skin archive. The ThemeLoader's failure to validate archive member names is the core flaw; exploitation is limited by needing local user interaction (loading the skin) and social engineering to deliver the file. Affected versions are VLC media player before 3.0.24. Impact executes with the privileges of the VLC user, so no privilege escalation is inherent.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) is internally consistent with the description: exploitation is LOCAL (AV:L) because a victim must open an attacker-supplied .vlt skin archive, and passive user interaction (UI:P) is required. Full CIA impact (VC:H/VI:H/VA:H) is credible because arbitrary file write with VLC user privileges plus Lua script injection yields code execution in the user's context. This is a real, high-severity issue but NOT a remote drive-by: the AV:L designation and UI:P requirement mean it depends on social engineering (getting a user to load a malicious skin), which materially lowers real-world urgency compared to a network-exploitable RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or mass automation - exploitation status is 'no public exploit identified at time of analysis.' The vulnerability is confirmed by the vendor (fixing commits exist) and by VulnCheck's advisory, giving high confidence in the technical claim, but the practical risk is gated by the niche skins2 interface (VLC's default UI is Qt, not skins2) and by requiring user-initiated skin loading.

An attacker crafts a malicious .vlt skin archive containing member names with path-traversal sequences (e.g. '../../') and a Lua payload, then distributes it via a skin-sharing site, forum, or phishing lure. When a victim loads the skin in VLC's skins2 interface, the unvalidated ThemeLoader writes files outside the intended extraction directory, planting a Lua script that VLC subsequently executes, running attacker code with the victim's privileges. No public POC is identified in the provided data.