Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory
Two VLC 3.0 flaws, CVE-2026-56711 (heap corruption, CVSS 8.6) and CVE-2026-73324 (memory leak), let crafted PNGs or RTSP playlists corrupt memory or leak data.
Hap Security researcher Fabian Wahle disclosed two VLC Media Player flaws on September 9, 2026, affecting versions 3.0.0 through 3.0.23. CVE-2026-56711 (CVSS 8.6) is an integer overflow and out-of-bounds write in the AllocatePicture function, exploitable via a crafted PNG with oversized IHDR dimensions, potentially causing crashes or code execution. CVE-2026-73324 (CVSS 6.9) lets a malicious RTSP server read adjacent heap memory through an unterminated 4096-byte response line, triggerable via a realrtsp playlist URL. No patched release is confirmed yet; users should avoid untrusted media files, playlists, and RTSP streams.
- CVE-2026-56711: integer overflow in picture allocation enables heap corruption and possible code execution via crafted PNG (CVSS 8.6)
- CVE-2026-73324: unterminated RTSP response buffer lets malicious RTSP servers read adjacent heap memory (CVSS 6.9)
- Flaws affect VLC 3.0.0 through 3.0.23; the vulnerable RTSP module ships in official VideoLAN builds
- No fix confirmed yet; avoid untrusted PNG files, playlists, and RTSP streams and restrict VLC in high-risk environments
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-56711 | Heap buffer overflow in VLC media player via integer overflow in picture allocation VLC media player contains an integer overflow (CWE-190) in its picture buffer allocation: in AllocatePicture (src/misc/picture.c) the byte total is accumulated with 32-bit arithmetic, so for very large picture dimensions the product of plane pitch and lines wraps before it is widened to a 64-bit size, and both existing guard checks evaluate only the already-wrapped value. As a result, aligned_alloc reserves a much smaller buffer than the picture actually requires, and a crafted PNG whose IHDR chunk declares very large width and height values - which reaches the code through the image demuxer that only limits the input file's byte count, not the declared dimensions - causes the PNG decoder (modules/codec/png.c) to write past the end of the allocation with attacker-influenced length and content (CWE-787). Opening the malicious PNG file directly or through a playlist entry is sufficient to trigger the flaw under default settings, and per the high CVSS 4.0 score (8.6) the attacker gains high confidentiality, integrity, and availability impact on the player process, i.e., controlled heap corruption that can crash VLC and potentially execute code. All VLC users who open untrusted image files are potentially affected; the available data does not specify affected version ranges. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so no exploitation has been reported to date. Do: Until a patched VLC release is available, avoid opening untrusted PNG image files or playlist entries referencing images with VLC, and consider setting a different application as the default PNG handler. No fixed version is specified in the available data, so monitor VideoLAN advisories for an update addressing CVE-2026-56711 and apply it promptly when released. | 7.3 | <1% |
| massplausibly hundreds of millions of desktop installations (VLC has billions of cumulative downloads) | ||
| CVE-2026-73324 | Out-of-Bounds Read in VLC Media Player RTSP Module Leaks Heap Memory to Servers VLC media player's RTSP access module contains an out-of-bounds read caused by improper null-termination: RtspReadLine uses strncpy with the full buffer length (writing no terminator when the response line is as long as the destination), and rtsp_get then passes the 4096-byte BUF_SIZE buffer to strdup, which reads past the end of the heap allocation whenever a server returns a line of 4096 bytes or more. The flaw is triggered simply by opening a playlist entry that names a realrtsp URL, and the attacker controls the line length and therefore how far the over-read runs. Because the affected line is the Session header, the disclosed bytes are retained as the session identifier and sent back to the server on every subsequent request, so the operator of a hostile server directly receives adjacent client heap memory (high confidentiality impact with no integrity or availability impact, per the CVSS 4.0 score of 6.9). Anyone using a VLC build with the RTSP module enabled is affected — the official VideoLAN builds enable it, while some distribution packages ship it disabled — and user interaction is required. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS assigns a 0.3% probability of exploitation within 30 days and the flaw is not in CISA's KEV. Do: Verify whether your VLC build includes the RTSP access module (official VideoLAN builds do; some Linux distributions ship it disabled). Until a patched release is identified — the disclosure data does not list a fixed version — avoid opening playlists or stream links pointing to realrtsp/RTSP URLs from untrusted servers, or disable the RTSP access module. Monitor VideoLAN for an updated release addressing CVE-2026-73324. | 5.3 | <1% |
| mass≈100M+ VLC users (official VideoLAN builds ship the RTSP module enabled; only users who open hostile realrtsp/RTSP links are actually at risk) |
Full article615 words · extracted from cybersecuritynews.com · click to collapse
Two security vulnerabilities in VLC Media Player could allow attackers to corrupt heap memory or disclose sensitive data from a victim’s memory.
The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC Media Player versions 3.0.0 through 3.0.23 and require a victim to open a specially crafted media file or playlist entry.
Fabian Wahle of Hap Security discovered the vulnerabilities. CVE-2026-56711 carries a high severity rating with a CVSS score of 8.6, while CVE-2026-73324 is rated medium severity with a CVSS score of 6.9. Both issues were disclosed on September 9, 2026.
CVE-2026-56711 is an integer overflow and out-of-bounds write vulnerability in VLC’s picture-buffer allocation logic. The flaw is associated with CWE-190, Integer Overflow or Wraparound, and CWE-787, Out-of-bounds Write.
The issue exists in the AllocatePicture function within VLC’s src/misc/picture.c component. VLC calculates the total buffer size required for decoded image planes by adding values derived from i_pitch * i_lines. Both values are defined as signed int fields in include/vlc_picture.h.
Because the multiplication uses 32-bit arithmetic, a malicious image with extremely large dimensions can cause the calculated value to wrap around. VLC may then allocate a much smaller memory region than the decoder actually needs.
Existing checks do not adequately prevent the condition. One validation routine performs division using 64-bit arithmetic, but it does not constrain the preceding 32-bit multiplication. Another check evaluates the already-wrapped result, allowing the malicious dimensions to pass validation.
An attacker can exploit the flaw using a crafted PNG image with oversized width and height values in its IHDR header. VLC’s image demuxer checks the input file size but does not properly validate declared image dimensions.
When the PNG decoder processes scanlines based on the original attacker-controlled dimensions, it writes beyond the small allocated heap buffer.
Successful exploitation could cause heap memory corruption, application crashes, or potentially arbitrary code execution, depending on the memory layout and platform protections.
CVE-2026-73324 affects VLC’s RTSP access module and can expose heap memory to a malicious RTSP server. The vulnerability is classified as CWE-125 (Out-of-bounds Read) and CWE-170 (Improper Null Termination).
The bug occurs when VLC reads RTSP response lines in modules/access/rtsp/access.c. The RtspReadLine function uses strncpy to copy a response line into a fixed-size buffer. However, if the server-controlled line is at least 4096 bytes long, strncpy does not append a null terminator.
VLC later passes this unterminated buffer to strdup in modules/access/rtsp/rtsp.c. Since strdup expects a null-terminated C string, it continues reading memory beyond the allocated buffer until it finds a zero byte.
The vulnerable input is the RTSP Session header. VLC stores the copied data as a session identifier and sends it back to the RTSP server in later requests. This behavior gives a hostile server a direct way to receive adjacent heap memory from the VLC client.
A malicious playlist containing a realrtsp URL can trigger the flaw when the victim opens it. The RTSP module is optional at build time, meaning exposure may vary between Linux distribution packages. However, it is enabled in official VideoLAN builds.
The vulnerabilities affect VLC Media Player versions 3.0.0 through 3.0.23. Users should monitor VideoLAN’s official project repository and distribution-maintainer advisories for security updates and patched releases.
Until fixes are available, users should avoid opening PNG files, media playlists, and RTSP streams received from untrusted sources. Organizations should also restrict VLC execution in high-risk environments, block untrusted RTSP connections where practical, and use endpoint monitoring to detect suspicious media files or playlist-based delivery attempts.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/multiple-vlc-media-player-vulnerabilities/