Multiple VLC Media Player Vulnerabilities Allow Heap Corruption and Data Disclosure
Two vulnerabilities in VLC Media Player, CVE-2026-56711 and CVE-2026-73324, allow attackers to corrupt heap memory or read sensitive data.
Two security vulnerabilities discovered in VLC Media Player, a widely used open-source media player, could allow attackers to corrupt heap memory or disclose sensitive data from a victim's memory. The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC Media Player versions 3.0.0 through 3.0.23. Exploitation requires a victim to open a specially crafted media file or playlist entry, making it a targeted attack vector.
CVE-2026-56711, rated with high severity and a CVSS score of 8.6, is an integer overflow and out-of-bounds write vulnerability. This issue arises in the AllocatePicture function within VLC’s src/misc/picture.c component. The vulnerability stems from how VLC calculates the total buffer size for decoded image planes. By using 32-bit arithmetic for multiplication with potentially large image dimensions, the calculated value can wrap around, leading VLC to allocate a significantly smaller memory region than required by the decoder. Existing validation routines fail to adequately prevent this condition, allowing an attacker to exploit the flaw using a crafted PNG image with oversized width and height values in its IHDR header.
When the PNG decoder processes scanlines based on these attacker-controlled dimensions, it writes beyond the small allocated heap buffer. Successful exploitation of CVE-2026-56711 could lead to heap memory corruption, application crashes, or potentially arbitrary code execution, depending on the specific memory layout and platform protections in place.
The second vulnerability, CVE-2026-73324, carries a medium severity rating with a CVSS score of 6.9. This flaw affects VLC’s RTSP access module and can expose heap memory to a malicious RTSP server. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and CWE-170 (Improper Null Termination). It occurs when VLC reads RTSP response lines in modules/access/rtsp/access.c. The RtspReadLine function uses strncpy to copy a response line into a fixed-size buffer. If the server-controlled line is at least 4096 bytes long, strncpy fails to append a null terminator.
VLC later passes this unterminated buffer to strdup in modules/access/rtsp/rtsp.c. Since strdup expects a null-terminated C string, it continues reading memory beyond the allocated buffer until it encounters a zero byte. The vulnerable input is the RTSP Session header. VLC stores this copied data as a session identifier and sends it back to the RTSP server in subsequent requests. This mechanism provides a direct channel for a hostile server to receive adjacent heap memory from the VLC client, potentially disclosing sensitive information.
Both vulnerabilities were discovered by Fabian Wahle of Hap Security and were publicly disclosed on September 9, 2026. The RTSP module, while optional at build time on some systems, is enabled in official VideoLAN builds, meaning a significant number of users could be affected.
Users of VLC Media Player are strongly advised to update to patched versions as soon as they become available from VideoLAN or their distribution maintainers. Until then, users should exercise extreme caution and avoid opening PNG files, media playlists, or RTSP streams received from untrusted sources. Organizations should consider restricting VLC execution in high-risk environments and implementing network monitoring to detect suspicious media file or playlist-based delivery attempts.