With faster decoding on multi-core, GPU, and mobile hardware and the ability to open more formats, notably professional, HD and 10bits codecs, 3.0 is a major upgrade for VLC. Twoflower has a new rendering pipeline for video, with higher quality subtitles, and new video filters to enhance your videos. It supports many new devices and BluRay Discs (experimental). Completely reworked Mac and Web interfaces and improvements in the other interfaces make VLC easier than ever to use.

Video

  • Rewritten video output core and modules, allowing subpicture blending in GPU.
  • Shader support in the OpenGL output, for colorspace conversion, including 10bits.
  • New video outputs for Windows 7, Android, iOS and OS/2.
  • New debanding, grain, denoising and anti-flickering filters.
  • New deinterlacing filter, including an Inverse Telecine algorithm.

Audio

  • New resamplers for higher quality audio.
  • New dynamic range compressor and karaoke filters.
  • Simplification of the audio core for faster processing.
  • New audio outputs for iOS, Android and OS/2.

Formats

  • Multi-threaded decoding for H.264, MPEG-4/Xvid and WebM.
  • Support for 10bits codecs, WMV image and some other codecs.
  • Rewritten support for images, including jpeg, png, xcf, bmp...
  • Important changes in RealVideo and Real Format support.
  • CrystalHD cards and Android OpenMAX support for hardware decoding.

Input and Devices

  • Experimental support for BluRay discs:
    • Menus are deactivated in this release (will come soon).
    • AACS and BD+ DRM libraries and keys are not shipped, for legal reasons.
  • Support for SDI capture cards and QTKit devices.
  • Support for new adaptive streaming protocols, like HLS and DASH.

For Mac Users

  • Completely new, single window interface:
    • Available in 2 colors: Lion grey and QTX black.
    • Extensions support and better Lion integration.
  • Support for all QTKit devices through qtcapture and qtsound modules.
  • Continued support for X 10.5 and PPC users (1080p and ProRes on Dual-G5!).

For Anime Fans

  • Vastly improved MKV demuxer.
  • Rewritten linked segments and ordered chapter files support.
  • Correct support for FLAC, RV and Hi10p in MKV.
  • Rewritten seeking support in cue files.
  • Various ASS subtitles improvements.

For professional Users

  • Support for ProRes 422 and 4444, AVC/Intra.
  • Support for Jpeg-2000 and DNxHD/VC-3 in 10bits.
  • Support for EBU subtitles (stl) and EIA-608.
  • SDI and HD-SDI card support for input on Linux.
  • New Dirac/VC-2 encoder, faster than the previous one.

For Developers

  • libVLC, libVLCcore and libcompat have switched from GPL to LGPLv2.1+.
  • New libVLC examples are available: media player, photobooth and mediainfo clones.
  • New JSON requests on the web interface to control running VLC instances.
  • Implementation of the MPRIS2 interface to control media players.
  • VLC's web plugins have been rewritten for better integration and stability in all browsers.

What's New

Decoders:

  • Improve Opus ambisonic support
  • Fix some ASS subtitle rendering issues
  • Fix Opus in MP4 behaviour
  • Fix VAAPI hw decoding with some drivers

Input:

  • Add support for HTTP content range handling according to RFC 9110
  • Fix some HLS Adaptive Streaming not working in audio-only mode

Video Output:

  • Super Resolution scaling with AMD GPUs
  • The D3D11 HDR option can also turn on/off HDR for all sources regardless of the display
  • Improve subtitles rendering on Apple platforms of notably Asian languages by correcting font fallback lookups

Video Filter:

  • New AMD VQ Enhancer filter
  • Add D3D11 option to use NVIDIA TrueHDR to generate HDR from SDR sources

Audio Output:

  • Fix regression on macOS causing crashes when using audio devices with more than 9 channels

Services Discovery:

  • Fix exposed UPnP directory URL schemes to be compliant with RFC 3986

Contrib:

  • Update FFmpeg to 4.4.4
  • Update dav1d to 1.4.2
  • Update libvpx to 1.14.1

libVLC:

  • The HWND passed to libvlc_media_player_set_hwnd must have the WS_CLIPCHILDREN style set.
  • Fix crashes when using caopengllayer

Misc:

  • Fix various warnings, leaks and potential crashes
  • Fix security integer overflow in MMS module

Security:

  • A denial of service through a potential integer overflow could be triggered with a maliciously crafted mms stream (heap based overflow)

Impact

  • If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
  • While these issues in themselves are most likely to just crash the player, we can't exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.
  • We have not seen exploits performing code execution through this vulnerability.

Threat mitigation

  • Exploitation of those issues requires the user to explicitly open a maliciously crafted mms stream.

Workarounds

  • The user should refrain from opening mms streams from untrusted third parties (or disable the VLC browser plugins), until the patch is applied.

Solution

  • VLC media player 3.0.21 addresses the issue.