In general, heap over-reading can help with ASLR bypass, but not in this case.
As it turned out, researchers made mistakes.
they did not check the version of the vulnerable library in the latest VLC
they mistakenly added RCE speculations which cannot be proved after I asked various experts and debugged thing by myself
and there seems to be no possibility ...
There are two distinct questions here:
How easy is it to trigger the vulnerability? In other words, how easy is it to make the program do something it isn't supposed to do?
How severe is the vulnerability? In other words, if you can trigger it, what can you do with it?
The answer to the first question is: very easy. VLC is a video player, and you can ...
The reason why CVSS scores are high, even though an issue is difficult to exploit, is because CVSS ignores the likelihood of some things.
For example, if an exploit requires the user to open a media file, it gets the attribute "User interaction required". An exploit that would require the user to ignore an explicit warning also gets the attribute "User ...