VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data
VLC 3.0.0-3.0.23 has two flaws: a heap out-of-bounds write via malicious PNGs (CVE-2026-56711) and an out-of-bounds read via hostile RealRTSP servers.
CVE-2026-56711 is a heap out-of-bounds write (CVSS v4 8.6) caused by an integer overflow in VLC's AllocatePicture routine when processing PNG images with exceptionally large IHDR width and height values, allowing writes past the allocated buffer; it maps to CWE-190 and CWE-787 and was credited to Fabian Wahle of Hap Security. CVE-2026-73324 is a medium-severity out-of-bounds read (CVSS v4 6.9) in VLC's RealRTSP handling, where RtspReadLine copies response lines longer than 4,096 bytes into a fixed buffer without null termination, potentially leaking heap data back to a hostile RTSP server via the Session header. Both bugs affect VLC 3.0.0 through 3.0.23, and updated builds had not yet been released at the time of disclosure.
- CVE-2026-56711 (CVSS 8.6) is a heap out-of-bounds write triggered by crafted PNG images with oversized dimensions.
- An integer overflow in AllocatePicture wraps the buffer size so the PNG decoder writes beyond the allocation.
- CVE-2026-73324 (CVSS 6.9) leaks heap data through unterminated RTSP response lines echoed to hostile servers.
- Users should avoid untrusted PNG files and RealRTSP playlist entries until patched VLC builds ship.
- Vendors
- VideoLANHap Security
- Products
- VLC Media Player
- Organizations
- Hap SecurityVideoLAN
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-56711+1 related CVE | Heap buffer overflow in VLC media player via integer overflow in picture allocation | 7.3 group max | <1% |
From the original article
2 min read at gbhackers.com
Two security vulnerabilities in VLC media player versions 3. 0. 0 through 3.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.