VLC 3.0.24 lands with over 130 security fixes
VLC 3.0.24 is a major security update for the world's most-used media player: more than 130 fixes across the player and its bundled libraries, an FFmpeg leap from 4.4 to 8.1.2, and 49 updated third-party libraries.
VLC, the free media player that quietly became the default video app on every platform that matters, has shipped version 3.0.24 with more than 130 security fixes across the player and the libraries it bundles. VideoLAN calls it a major security update, and the release notes promise the security advisories will be updated a few days after the release, so anyone running VLC on a shared or public machine should treat this as a patch-you-actually-install release.
The headline engineering item is the decoder stack. VLC now builds on FFmpeg 8.1.2, leaping four major versions from the 4.4 base the 3.x series had carried, and 49 bundled third-party libraries were updated in the same sweep. That matters because most of those 130-odd fixes live in exactly those codecs and parsers, the parts of a media player that parse whatever a stranger hands it.
New tricks in an old branch
This is the twenty-fifth release of the Vetinari branch, and it still finds room for features: ATRAC decoding for Sony's legacy audio formats, CEA-708 captions in MP4 files, an SRT listener mode and NV12 DirectShow capture on Windows. Two long-standing irritations are fixed too: slow Windows startup when daylight saving time changes, and a MIDI playback crash on macOS 26 and later.
That a non-profit foundation can keep a twenty-five-year-old player's maintenance branch this current is the quiet flex here. While commercial suites argue about subscription tiers, VLC's 3.x line is absorbing a four-generation FFmpeg jump without asking users to relearn anything.
Our opinion
Update now, especially on Windows. A media player is a parser of untrusted input by definition, and 130 security fixes in one drop means 130 reasons a malformed file was previously a problem. The FFmpeg 8.1.2 jump is the part everyone else should be jealous of: VideoLAN has shown you can carry a legacy branch forward without freezing its guts in 2021. The only disappointment is that the detailed advisories trail the release by a few days, which is honest engineering but awkward timing for anyone deciding how urgently to roll it out. Roll it out anyway.