ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

Hap Security

2 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Search everything

Timeline

Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory

Two VLC 3.0 flaws, CVE-2026-56711 (heap corruption, CVSS 8.6) and CVE-2026-73324 (memory leak), let crafted PNGs or RTSP playlists corrupt memory or leak data.

Hap Security researcher Fabian Wahle disclosed two VLC Media Player flaws on September 9, 2026, affecting versions 3.0.0 through 3.0.23. CVE-2026-56711 (CVSS 8.6) is an integer overflow and out-of-bounds write in the AllocatePicture function, exploitable via a crafted PNG with oversized IHDR dimensions, potentially causing crashes or code execution. CVE-2026-73324 (CVSS 6.9) lets a malicious RTSP server read adjacent heap memory through an unterminated 4096-byte response line, triggerable via a realrtsp playlist URL. No patched release is confirmed yet; users should avoid untrusted media files, playlists, and RTSP streams.

Cyber Security News · 3d agoVulnerability 2 sourcesCVE-2026-56711CVE-2026-733241

VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

VLC 3.0.0-3.0.23 has two flaws: a heap out-of-bounds write via malicious PNGs (CVE-2026-56711) and an out-of-bounds read via hostile RealRTSP servers.

CVE-2026-56711 is a heap out-of-bounds write (CVSS v4 8.6) caused by an integer overflow in VLC's AllocatePicture routine when processing PNG images with exceptionally large IHDR width and height values, allowing writes past the allocated buffer; it maps to CWE-190 and CWE-787 and was credited to Fabian Wahle of Hap Security. CVE-2026-73324 is a medium-severity out-of-bounds read (CVSS v4 6.9) in VLC's RealRTSP handling, where RtspReadLine copies response lines longer than 4,096 bytes into a fixed buffer without null termination, potentially leaking heap data back to a hostile RTSP server via the Session header. Both bugs affect VLC 3.0.0 through 3.0.23, and updated builds had not yet been released at the time of disclosure.

GBHackersupdated · 3d agofirst · 4d agoVulnerability 2 sourcesCVE-2026-56711CVE-2026-73324

Related CVEs

  • CVE-2026-567117.3<1%
    Heap buffer overflow in VLC media player via integer overflow in picture allocation
    VLC media player contains an integer overflow (CWE-190) in its picture buffer allocation: in AllocatePicture (src/misc/picture.c) the byte total is accumulated with 32-bit arithmetic, so for very large picture dimensions the product of plane pitch and lines wraps before it is widened to a 64-bit size, and both existing guard checks evaluate only the already-wrapped value. As a result, aligned_alloc reserves a much smaller buffer than the picture actually requires, and a crafted PNG whose IHDR chunk declares very large width and height values - which reaches the code through the image demuxer that only limits the input file's byte count, not the declared dimensions - causes the PNG decoder (modules/codec/png.c) to write past the end of the allocation with attacker-influenced length and content (CWE-787). Opening the malicious PNG file directly or through a playlist entry is sufficient to trigger the flaw under default settings, and per the high CVSS 4.0 score (8.6) the attacker gains high confidentiality, integrity, and availability impact on the player process, i.e., controlled heap corruption that can crash VLC and potentially execute code. All VLC users who open untrusted image files are potentially affected; the available data does not specify affected version ranges. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so no exploitation has been reported to date.
    · VideoLAN VLC media playermass
  • CVE-2026-733245.3<1%
    Out-of-Bounds Read in VLC Media Player RTSP Module Leaks Heap Memory to Servers
    VLC media player's RTSP access module contains an out-of-bounds read caused by improper null-termination: RtspReadLine uses strncpy with the full buffer length (writing no terminator when the response line is as long as the destination), and rtsp_get then passes the 4096-byte BUF_SIZE buffer to strdup, which reads past the end of the heap allocation whenever a server returns a line of 4096 bytes or more. The flaw is triggered simply by opening a playlist entry that names a realrtsp URL, and the attacker controls the line length and therefore how far the over-read runs. Because the affected line is the Session header, the disclosed bytes are retained as the session identifier and sent back to the server on every subsequent request, so the operator of a hostile server directly receives adjacent client heap memory (high confidentiality impact with no integrity or availability impact, per the CVSS 4.0 score of 6.9). Anyone using a VLC build with the RTSP module enabled is affected — the official VideoLAN builds enable it, while some distribution packages ship it disabled — and user interaction is required. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS assigns a 0.3% probability of exploitation within 30 days and the flaw is not in CISA's KEV.
    · VideoLAN VLC media player (RTSP/realrtsp access module)mass

Appears with

product VLC Media Player 2vendor VideoLAN 2organization VideoLAN 1vendor Hap Security 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.