VLC Media Player version 0.8.6h for Windows contains a vulnerability which can be used to execute arbitrary code. This vulnerability works by exploiting the "Open()" function in modules/demux/wav.c. A hacker can use a specially crafted WAV file to exploit this function to execute their trojans, viruses, spyware, keyloggers, and whatever other kind of malware they want.

Thankfully a update is beening released, so everyone can protect themselves simply by updating to version 0.8.6i. You can download the update at their website and even download VLC media player's source code if you want to examine it.