There are two distinct questions here:
- How easy is it to trigger the vulnerability? In other words, how easy is it to make the program do something it isn't supposed to do?
- How severe is the vulnerability? In other words, if you can trigger it, what can you do with it?
The answer to the first question is: very easy. VLC is a video player, and you can trigger the vulnerability with a video file. Just how hard is it to convince someone to watch a video? “Hey, look at these kittens!” And actually that's the hard way: the easy way is to embed the video in a web page. For a few dollars, buy some ad space, and the videos will play on websites such as Stack Exchange). VLC is available as a browser plugin (although only on older browsers, I think), so anyone whose browser is configured to play videos through VLC and whose version of VLC is vulnerable would be affected, even if they don't do anything to play the video.
Given that all it takes to trigger the vulnerability is to trigger a web page, exploitation is as easy as it gets. The reaction from the VLC developer on this aspect demonstrates a scary lack of understanding. (Their reaction on other topics, such as the fact that the vulnerability turned out not to be in VLC, is more understandable.)
The second question is how bad it can be if the vulnerability is triggered. I haven't analyzed the code, but it's a buffer overread, so the potential is limited. If I understand correctly, this is code that reads from a video, and that can cause data to be read past the end of the video in memory. The data is supposed to be from the video file, so it could be anything: the software shouldn't be assuming anything about the content anyway, so this can't be a way to inject bad data. The two bad things that can happen are a crash and an information leak.
A crash will happen if the read reaches a memory address that isn't mapped. (I'm assuming an operating system with memory protection; as far as I know, VLC only runs on such operating systems.) This is deterministic behavior: if the read reaches an unmapped address, the program will stop due to a segmentation fault or the Windows equivalent. So this could be a denial of service at most.
In conclusion, this particular vulnerability (which by the way isn't in VLC, but in some library that VLC uses) is easy to exploit, but the exploit doesn't have much potential for doing anything bad.