CVE-2026-73324

VLC media player's RTSP access module contains an out-of-bounds read caused by improper null-termination: RtspReadLine uses strncpy with the full buffer length (writing no terminator when the response line is as long as the destination), and rtsp_get then passes the 4096-byte BUF_SIZE buffer to strdup, which reads past the end of the heap allocation whenever a server returns a line of 4096 bytes or more. The flaw is triggered simply by opening a playlist entry that names a realrtsp URL, and the attacker controls the line length and therefore how far the over-read runs. Because the affected line is the Session header, the disclosed bytes are retained as the session identifier and sent back to the server on every subsequent request, so the operator of a hostile server directly receives adjacent client heap memory (high confidentiality impact with no integrity or availability impact, per the CVSS 4.0 score of 6.9). Anyone using a VLC build with the RTSP module enabled is affected — the official VideoLAN builds enable it, while some distribution packages ship it disabled — and user interaction is required. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS assigns a 0.3% probability of exploitation within 30 days and the flaw is not in CISA's KEV.

What to do: Verify whether your VLC build includes the RTSP access module (official VideoLAN builds do; some Linux distributions ship it disabled). Until a patched release is identified — the disclosure data does not list a fixed version — avoid opening playlists or stream links pointing to realrtsp/RTSP URLs from untrusted servers, or disable the RTSP access module. Monitor VideoLAN for an updated release addressing CVE-2026-73324.