42
Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory
Two VLC 3.0 flaws, CVE-2026-56711 (heap corruption, CVSS 8.6) and CVE-2026-73324 (memory leak), let crafted PNGs or RTSP playlists corrupt memory or leak data.
Hap Security researcher Fabian Wahle disclosed two VLC Media Player flaws on September 9, 2026, affecting versions 3.0.0 through 3.0.23. CVE-2026-56711 (CVSS 8.6) is an integer overflow and out-of-bounds write in the AllocatePicture function, exploitable via a crafted PNG with oversized IHDR dimensions, potentially causing crashes or code execution. CVE-2026-73324 (CVSS 6.9) lets a malicious RTSP server read adjacent heap memory through an unterminated 4096-byte response line, triggerable via a realrtsp playlist URL. No patched release is confirmed yet; users should avoid untrusted media files, playlists, and RTSP streams.
52
42
30
60
VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data
VLC 3.0.0-3.0.23 has two flaws: a heap out-of-bounds write via malicious PNGs (CVE-2026-56711) and an out-of-bounds read via hostile RealRTSP servers.
CVE-2026-56711 is a heap out-of-bounds write (CVSS v4 8.6) caused by an integer overflow in VLC's AllocatePicture routine when processing PNG images with exceptionally large IHDR width and height values, allowing writes past the allocated buffer; it maps to CWE-190 and CWE-787 and was credited to Fabian Wahle of Hap Security. CVE-2026-73324 is a medium-severity out-of-bounds read (CVSS v4 6.9) in VLC's RealRTSP handling, where RtspReadLine copies response lines longer than 4,096 bytes into a fixed buffer without null termination, potentially leaking heap data back to a hostile RTSP server via the Session header. Both bugs affect VLC 3.0.0 through 3.0.23, and updated builds had not yet been released at the time of disclosure.
50
30
60
55
60
60
42
60
30
42
30
30
57
57
60
60
55
Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week
GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.
GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.
15
42
42
30
30
30
47
30
55
30
30
55
30
35
42
Researcher Explains Release of Undisclosed Zero
60
60
42