The cone has been busy

VLC makes its ‘biggest security release ever’

by · omg! ubuntu · Join

VLC 3.0.24 is out, billed as the video player’s ‘biggest security release ever’ with more than 130 fixes across the app and its bundled libraries.

VideoLAN president Jean-Baptiste Kempf says the bulk of security flaws patched by the update are “hard to exploit in practice”, e.g., out-of-bounds reads and writes, integer overflow, use-after-free issues, etc. He adds not all are ‘harmless’ and encourages users to update.

No major new user-facing features arrive in this update to the open-source media player, but improvements do.

VLC 3.0.24 supports ATRAC3 and ATRAC9 decoding (the former used by Sony MiniDiscs the latter for PSP-era audio), CEA-708 closed captions in MP4 files and, by way of a large version leap in FFmpeg, support for Samsung’s APV high-quality video files.

Other changes in v3.0.24:

  • SRT listener mode
  • SFTP public key authentication options
  • WebVTT (.vtt) handling improvements
  • Subtitle language detection via filenames and metadata
  • librist for RIST input and output with Main and Simple profiles
  • Chromecast model shown in mDNS renderer names
  • HEVC disabled for original Chromecast devices
  • Super Resolution scaling on Moore Threads GPUs
  • FFmpeg updated from v4.4 to 8.1.2
  • NPAPI browser plugin removed
  • Update validation now uses an RSA-4096 key
  • Qt fix for default open dialog location
  • Flatpak build support

There’s also a bug fix to solve a quirky issue that caused VLC to start up slowly on first launch after a change in Daylight Saving Time.

VLC’s continued versatility

PowerVLC: modern VLC on not-so-modern devices

Some other ‘huh, that’s cool’ news about VLC of late. A third-party fork, PowerVLC, back-ports the VLC 3.x series to Apple devices using older PPC processors and adds optimisations and tweaks to get it running well on versions as old as Mac OS X 10.2 from 2002.

Linux benefits from the effort too.

Jeroen Diederen, the lead developer of MintPPC, a Debian-based version of Linux Mint for old PowerPC Macs, decided to port the fork over to Linux – and it works! I’m tempted to blow the dust off of my old iBook G4 and try it out.

Get VLC 3.0.24

Download VLC 3.0.24 from the official website, which provides installers for Windows and macOS, with an official snap package providing the latest build to users on Ubuntu – get that from App Center or run sudo snap install vlc.

Other ways to get it on Linux include from an unofficial VLC Flathub listing, and you might find it in one of the huge number of VLC PPAs (most are outdated, though).

VLC 3.0.24 is the version available in the Ubuntu 26.10 archives as a traditional Debian package.

Normally, I’d say something like “don’t feel pressured to chase down the update”, but, well, critical security updates are more critical than the usual assortment of mux tweaks and decoder bumps.

The upcoming VLC 4.0 series is where the more substantive changes are happening. If you want to check in with the status of that work, install the VLC snap from the edge channel on Ubuntu.