--- title: VLC got its ‘biggest security release ever’ | daily.dev description: VLC 3.0.24 has shipped as the media player's largest security release to date, fixing over 130 vulnerabilities across the app and its bundled libraries,... canonical: https://daily.dev/posts/vlc-got-its-biggest-security-release-ever--focb0jslu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: VLC got its ‘biggest security release ever’ | daily.dev og:description: VLC 3.0.24 has shipped as the media player's largest security release to date, fixing over 130 vulnerabilities across the app and its bundled libraries,... og:url: https://daily.dev/posts/vlc-got-its-biggest-security-release-ever--focb0jslu og:image: https://api.daily.dev/og/posts/fOCB0JSlU.png og:image:alt: VLC got its ‘biggest security release ever’ og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # VLC got its ‘biggest security release ever’ **[omg\! ubuntu\!](https://daily.dev/sources/omgub)** · 3 min read · 3 upvotes · 0 comments ## Summary VLC 3.0.24 has shipped as the media player's largest security release to date, fixing over 130 vulnerabilities across the app and its bundled libraries, including out-of-bounds, integer overflow, double-free and use-after-free issues. VideoLAN's Jean-Baptiste Kempf says most are hard to exploit but still urges users to update. Beyond security, the release adds ATRAC3/ATRAC9 decoding, CEA-708 closed captions in MP4, Samsung APV video support via a major FFmpeg upgrade (4.4 to 8.1.2), SRT listener mode, SFTP public key auth, RSA-4096 update validation, removal of the NPAPI browser plugin, and Flatpak build support. Bigger changes are planned for the upcoming VLC 4.0 series. Separately, a third-party fork called PowerVLC has backported VLC 3.x to PowerPC Macs running Mac OS X 10.2, and a Linux Mint PowerPC variant developer has ported that fork to Linux as well. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What's new and fixed in VLC 3.0.24? VLC 3.0.24 is billed as VideoLAN's biggest security release ever, patching over 130 vulnerabilities across the app and its bundled libraries, including out-of-bounds reads, integer overflows, double-free, and use-after-free bugs. VideoLAN president Jean-Baptiste Kempf says most are hard to exploit but still urges updating. FFmpeg was upgraded from 4.4 to 8.1.2, adding ATRAC3/ATRAC9 decoding, CEA-708 captions, and Samsung APV video support. _Track major player updates like this VLC release on daily.dev before deciding whether to update immediately._ ### Is it safe to keep using an older version of VLC before updating to 3.0.24? Not recommended, since 3.0.24 fixes over 130 security issues including out-of-bounds, integer overflow, double-free, and use-after-free bugs in VLC and its bundled libraries. VideoLAN's Jean-Baptiste Kempf notes most flaws are hard to exploit in practice but explicitly says not all of them are harmless, so users should update rather than delay. _Developers deciding when to patch media libraries can follow security releases like this one on daily.dev._ ### Why was VLC's NPAPI browser plugin removed in version 3.0.24? VLC 3.0.24 dropped the NPAPI browser plugin as part of a broader cleanup alongside the release's security fixes, since NPAPI is a legacy browser plugin architecture that modern browsers no longer support. The same release also replaced update validation with an RSA-4096 key and added Flatpak build support, reflecting a shift away from outdated integration methods. _Follow deprecations like NPAPI removal on daily.dev to keep legacy integrations from breaking unexpectedly._ ## Similar posts on daily.dev - [VLC crosses 7 billion downloads](https://daily.dev/posts/vlc-crosses-7-billion-downloads-5j20kknme) · TechCrunch · 0 upvotes · 0 comments - [Linux Release Roundup \(January 2026\)](https://daily.dev/posts/linux-release-roundup-january-2026--i1xiq6bgo) · omg\! ubuntu\! · 0 upvotes · 0 comments - [After 20 years together, VLC and I are finally breaking up, and it's because of this app](https://daily.dev/posts/after-20-years-together-vlc-and-i-are-finally-breaking-up-and-it-s-because-of-this-app-3cugbisim) · XDA Developers · 67 upvotes · 13 comments - [VLC's keeper of the cone nets European free software gong](https://daily.dev/posts/vlc-s-keeper-of-the-cone-nets-european-free-software-gong-gvplb1oos) · The Register · 13 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#linux](https://daily.dev/tags/linux), [#backend](https://daily.dev/tags/backend) [View this post on daily.dev](https://daily.dev/posts/vlc-got-its-biggest-security-release-ever--focb0jslu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"VLC got its ‘biggest security release ever’","url":"https://daily.dev/posts/vlc-got-its-biggest-security-release-ever--focb0jslu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vlc-got-its-biggest-security-release-ever--focb0jslu"},"datePublished":"2026-09-29T23:19:44.201Z","dateModified":"2026-09-29T23:20:09.163Z","description":"VLC 3.0.24 has shipped as the media player's largest security release to date, fixing over 130 vulnerabilities across the app and its bundled libraries,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/123db0410a8356f5fbaa8b462cdb7278?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/123db0410a8356f5fbaa8b462cdb7278?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"omg! ubuntu!","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"omg! ubuntu!","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/79e495adb3c3425785b9be27969a2562","url":"https://daily.dev/sources/omgub"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/vlc-got-its-biggest-security-release-ever--focb0jslu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,linux,backend","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"omg! ubuntu!","item":"https://daily.dev/sources/omgub"},{"@type":"ListItem","position":3,"name":"VLC got its ‘biggest security release ever’"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/vlc-got-its-biggest-security-release-ever--focb0jslu#faq","mainEntity":[{"@type":"Question","name":"What's new and fixed in VLC 3.0.24?","acceptedAnswer":{"@type":"Answer","text":"VLC 3.0.24 is billed as VideoLAN's biggest security release ever, patching over 130 vulnerabilities across the app and its bundled libraries, including out-of-bounds reads, integer overflows, double-free, and use-after-free bugs. VideoLAN president Jean-Baptiste Kempf says most are hard to exploit but still urges updating. FFmpeg was upgraded from 4.4 to 8.1.2, adding ATRAC3/ATRAC9 decoding, CEA-708 captions, and Samsung APV video support. Track major player updates like this VLC release on daily.dev before deciding whether to update immediately."}},{"@type":"Question","name":"Is it safe to keep using an older version of VLC before updating to 3.0.24?","acceptedAnswer":{"@type":"Answer","text":"Not recommended, since 3.0.24 fixes over 130 security issues including out-of-bounds, integer overflow, double-free, and use-after-free bugs in VLC and its bundled libraries. VideoLAN's Jean-Baptiste Kempf notes most flaws are hard to exploit in practice but explicitly says not all of them are harmless, so users should update rather than delay. Developers deciding when to patch media libraries can follow security releases like this one on daily.dev."}},{"@type":"Question","name":"Why was VLC's NPAPI browser plugin removed in version 3.0.24?","acceptedAnswer":{"@type":"Answer","text":"VLC 3.0.24 dropped the NPAPI browser plugin as part of a broader cleanup alongside the release's security fixes, since NPAPI is a legacy browser plugin architecture that modern browsers no longer support. The same release also replaced update validation with an RSA-4096 key and added Flatpak build support, reflecting a shift away from outdated integration methods. Follow deprecations like NPAPI removal on daily.dev to keep legacy integrations from breaking unexpectedly."}}]} ```