Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory
Two VLC 3.0 flaws, CVE-2026-56711 (heap corruption, CVSS 8.6) and CVE-2026-73324 (memory leak), let crafted PNGs or RTSP playlists corrupt memory or leak data.
Hap Security researcher Fabian Wahle disclosed two VLC Media Player flaws on September 9, 2026, affecting versions 3.0.0 through 3.0.23. CVE-2026-56711 (CVSS 8.6) is an integer overflow and out-of-bounds write in the AllocatePicture function, exploitable via a crafted PNG with oversized IHDR dimensions, potentially causing crashes or code execution. CVE-2026-73324 (CVSS 6.9) lets a malicious RTSP server read adjacent heap memory through an unterminated 4096-byte response line, triggerable via a realrtsp playlist URL. No patched release is confirmed yet; users should avoid untrusted media files, playlists, and RTSP streams.
- CVE-2026-56711: integer overflow in picture allocation enables heap corruption and possible code execution via crafted PNG (CVSS 8.6)
- CVE-2026-73324: unterminated RTSP response buffer lets malicious RTSP servers read adjacent heap memory (CVSS 6.9)
- Flaws affect VLC 3.0.0 through 3.0.23; the vulnerable RTSP module ships in official VideoLAN builds
- No fix confirmed yet; avoid untrusted PNG files, playlists, and RTSP streams and restrict VLC in high-risk environments
- Vendors
- VideoLAN
- Products
- VLC Media Player
- Organizations
- Hap Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-56711+1 related CVE | Heap buffer overflow in VLC media player via integer overflow in picture allocation | 7.3 group max | <1% |
From the original article
3 min read at cybersecuritynews.com
Two security vulnerabilities in VLC Media Player could allow attackers to corrupt heap memory or disclose sensitive data from a victim’s memory. The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC Media Player versions 3. 0.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.