14 JAN 2026 VIDEOLAN 4 min read

VLC 3.0.23

VLC 3.0.23: Vetinari is still maintained

Just before the holidays, we released VLC 3.0.23, the twenty-fourth release of the Vetinari branch of VLC media player, and the update is now rolling out everywhere.

The 3.0 branch shipped in February 2018. Almost eight years later, it still runs on hundreds of millions of machines, and like its namesake, it does not step down: it remains firmly in charge of the city until the succession is settled. VLC 4.0 is coming; in the meantime, Vetinari gets maintained.

And maintained regularly again: after a too-long gap between 3.0.21 and 3.0.22, this release comes only four weeks after the previous one. This is the same commitment I wrote about for our libraries last year: security and OS updates need actual releases, on an actual cadence.

What is in 3.0.23

This is a maintenance release, and a fairly typical one: it is mostly about subtitles, Windows, and security.

Codecs and demuxers

A surprising amount of VLC’s bug surface is subtitles and captions, and this release cleans up a cluster of it: fixed WebVTT line positioning, fixed CEA-708 closed-caption mask parsing, and better probing of malformed WebVTT and subtitle streams.

Also in the batch: better exposure of audio codec information, notably for 24-bit FLAC, and fixed decoding of some JPEG files with JFIF headers.

Windows

  • Fixed image display with Direct3D11;
  • Improved the dark palette of the Qt interface;
  • config_GetUserDir() no longer creates the folder it is asked about (#29488);
  • Fixed the compilation of the OpenGL modules.

And yes, VLC 3.0 still supports Windows XP SP3: it had quietly broken, and we fixed it in 3.0.22. People love to mock this, but plenty of kiosks, industrial machines and forgotten family PCs still run XP, and those are exactly the machines that will never see an OS patch again. A maintained media player is some of the only up-to-date software they will ever get. When we say VLC runs everywhere, we mean it.

Keeping an 8-year-old branch building in 2026

The least visible part of this release might be the most important one for distributions: preparatory compatibility work for taglib 2.0, Qt 6, FFmpeg 8, mingw-w64 v13, and newer versions of libplacebo and pupnp.

An 8-year-old branch does not keep compiling by itself. The toolchains and libraries underneath it move constantly, and every distro that rebuilds VLC 3.0 against this year’s stack depends on this quiet, unglamorous work. This is what maintenance actually looks like.

Security, and who pays for it

A media player is a machine that parses hostile input for a living. Every file, every stream, every random subtitle downloaded from the internet is untrusted data, going through parsers for dozens of formats, some of them written twenty years ago. Keeping that safe is not a one-time audit; it is permanent work.

3.0.23 fixes a solid batch of it: a null dereference in libass, an undefined shift in Theora and CC-708, an integer overflow in Daala, an infinite loop in H.264 parsing, a buffer overflow in PNG, several format overflows, and more robust handling of malformed Blu-ray, WebVTT and subtitle streams.

To be clear: these are the crafted-malicious-file class of issues, mostly found by fuzzing and responsible reports, and none of them is known to be exploited in the wild. That is what success looks like here: the bugs get found and fixed before they get found by the wrong people. You should not have to think about whether a subtitle file can hurt you, and with this release, you don’t. Update anyway.

This work does not happen by magic, and it does not happen for free. This release was made with a generous sponsorship of the Sovereign Tech Fund, as part of their investment in the VideoLAN ecosystem: public money, deliberately spent on the unglamorous maintenance of software that runs on hundreds of millions of machines.

Back in 2019, the EU-FOSSA bug bounty produced the biggest security release in VLC’s history. Six years later, the Sovereign Tech Fund is the mature version of that idea: not a one-off bounty, but sustained funding for the security and maintenance of open source infrastructure. Open source is infrastructure, and infrastructure needs funding, not applause. If more public institutions spent their security budgets this way, the whole internet would be better off.

Update

VLC will offer you the update itself, or you can grab it from videolan.org. If you fixed the family computer during the holidays, you probably already updated theirs; now do yours.

A good way to start the year, from VideoLAN with love. See you later in 2026 for 3.0.24, and for the bigger things ahead.