VLC 3.0.24

VLC 3.0.24: our biggest security release ever

VLC 3.0.24 is out, the twenty-fifth release of the Vetinari branch of VLC media player, and it is now rolling out to hundreds of millions of machines.

The 3.0 branch shipped in February 2018. Eight and a half years later, it is still the VLC that almost everyone runs, and it does not get to rot while we finish VLC 4.0. In January, I closed the 3.0.23 post with “see you later in 2026 for 3.0.24”. Promise kept, and this one is much bigger than routine maintenance.

More than 130 security fixes

Back in 2019, VLC 3.0.7 became the biggest security release in the history of the project, thanks to the EU-FOSSA bug bounty. That record stood for seven years. It just fell: 3.0.24 fixes more than 130 security issues across VLC and the libraries we ship with it.

The bugs themselves are what you expect from a large C codebase that parses hostile input for a living: out-of-bounds reads and writes, integer overflows, double frees, use-after-free, infinite loops on malformed files, and a long tail of strange parser edge cases. Most of them are hard to exploit in practice, but not all of them are harmless. In all cases, you should update.

Why so many at once? Partly because we have been putting serious, funded time into security and maintenance. But there is another reason that is hard to ignore: LLMs have changed the economics of finding bugs. Pointing tools at millions of lines of C full of twenty-year-old parsers has become cheap, and we now receive far more LLM-assisted security reports than we used to. The output is noisy: duplicates, unexploitable crashes, reports that need hours of triage before they mean anything. But some of the bugs are real.

And the costs are asymmetric: finding suspicious code got cheaper; reproducing the issue, deciding whether it is exploitable, fixing it correctly, reviewing the fix, backporting it to an eight-year-old branch and not shipping a regression did not get cheaper at all. I suspect this is the new normal for every large open-source project.

From FFmpeg 4.4 to 8.1.2

Even 130 undersells this release, because it also updates 49 third-party libraries, each carrying its own years of upstream security fixes. The big one is FFmpeg, jumping from 4.4 to 8.1.2: four major versions at once, underneath a stable branch that must not break. dav1d, libass, libarchive, GnuTLS, libxml2, libbluray, OpenJPEG, Opus, x265, zlib, libnfs, libsmb2 and many others move too. Old software does not keep building, or stay safe, by magic; someone has to keep the whole stack alive.

There are features hiding in that jump: FFmpeg 8 brings APV decoding, and VLC itself adds ATRAC3 and ATRAC9, so MiniDisc rips and PSP-era audio now play out of the box. Media preservation includes Sony’s weird proprietary formats too.

The rest of the new features, quickly: CEA-708 closed captions in MP4, SRT listener mode, SFTP public-key authentication with ED25519 host-key support, RIST input and output rebased on librist, and better subtitle language detection from filenames and SSA/ASS metadata. On Windows, NV12 DirectShow capture, UWP compatibility work, and a fix for the very slow startup when Daylight Saving Time changes (#29685). On macOS, the AudioToolbox MIDI synthesizer no longer crashes on recent versions. Plus the usual round of fixes in MKV, MP4, MPEG-TS, Ogg, AVI, WebVTT, FLAC and HEVC: the multimedia zoo never sleeps.

Some housekeeping too: the NPAPI browser plugin is gone, years after browsers removed the ability to run it, the long-broken youtube.lua went with it, and RealRTSP is no longer shipped. Full release notes are on videolan.org.

A new update key, after 13 years

There is one change you might actually notice, and I would rather you hear it from me than from a paranoid forum thread. The key VLC uses to verify its own updates dated from 2013, and it was DSA-1024. Neither of those facts aged well. 3.0.24 switches update verification to a new RSA-4096 key, and while we were in there, update checks now use HTTPS on Windows 7 and later.

Rotating the key that authenticates your updates is a classic bootstrap problem: how do you trust the new key? The transition works the way you would hope. Existing installations download the new public key, and that key is signed by the old one, which they already trust. So if you see VLC fetch a new VideoLAN public key during an update: this is expected. It is the transition mechanism, not your media player improvising key management.

Meanwhile, at IBC: a G3, a Pentium III and AV2

A few days before the release, VideoLAN was at IBC in Amsterdam, and our booth was not exactly broadcast-industry standard: we rebuilt a 1990s teenager’s bedroom, and filled it with real machines.

A 1998 iMac G3 was running VLC. Next to it, a 1999 Pentium III under Windows XP was doing real-time H.264 software decoding in a normal VLC build, as the client of a Kyber stream running Cyberpunk 2077 remotely on a modern machine. No special demo build; the old machine was actually doing the work.

On the other side of the booth, we showed nearly the opposite: dav2d, our open-source AV2 decoder, decoding 1080p AV2 on ordinary phones and tablets a few months after the specification was published, next to the latest VLC 4.0 work, including automatic subtitles in more than 180 languages.

The booth won the Best Booth award at IBC, which was nice. But the demo made the point better than the trophy: compatibility is not nostalgia. Keeping a 25-year-old computer useful and getting a brand-new codec to run on ordinary devices are the same engineering philosophy. Software should not decide that your hardware is dead, and a codec does not really exist until everyone can decode it. That has always been the deal with VLC: play almost anything, on almost anything. 3.0.24 still runs from Windows XP to Windows 11, from macOS 10.7 to current macOS, on Linux, the BSDs, and yes, OS/2.

Conclusion

Keeping old software alive and building the next generation are not opposite jobs. In open source, they are usually the same job.

A large part of this release, and especially the security work, was funded by the Sovereign Tech Fund: public money deliberately spent on the unglamorous maintenance of software that hundreds of millions of people rely on. Triaging hundreds of security reports, updating 49 libraries and rotating cryptographic keys produces no shiny screenshots, but it is the work that keeps a media player trustworthy. I wrote at length about why this model matters in January; all of it still applies. If you are German, you can thank your MPs.

VLC will offer you the update itself, or you can grab it from videolan.org. Update your machines, update your family’s machines, and then forget about it: that is the whole point.

Now, back to VLC 4.0. Patches welcome.