VLC Media Player users are urged to stay vigilant due to two newly identified vulnerabilities that could jeopardize data security. These flaws can be exploited to corrupt heap memory or access confidential information from a user’s memory.
Understanding the Vulnerabilities
The vulnerabilities, cataloged as CVE-2026-56711 and CVE-2026-73324, impact VLC Media Player versions from 3.0.0 to 3.0.23. They require users to engage with specifically crafted media files or playlist entries, which highlights the importance of cautious media handling.
These issues were identified by Fabian Wahle from Hap Security, with CVE-2026-56711 rated as high severity due to its CVSS score of 8.6, and CVE-2026-73324 rated at medium severity with a score of 6.9. Disclosures for both vulnerabilities occurred on September 9, 2026.
Technical Breakdown of CVE-2026-56711
CVE-2026-56711 is identified as an integer overflow and out-of-bounds write vulnerability within VLC’s picture-buffer allocation mechanism. The flaw is linked to CWE-190, which addresses Integer Overflow or Wraparound, and CWE-787, concerning Out-of-bounds Write.
The problem lies in the AllocatePicture function in VLC’s src/misc/picture.c component. It calculates buffer sizes for decoded images using i_pitch * i_lines, defined as signed int fields. However, 32-bit arithmetic can lead to a wraparound, causing insufficient memory allocation for decoding.
Exploiting this, attackers can use manipulated PNG images with exaggerated dimensions to bypass existing checks, resulting in potential heap memory corruption and other serious impacts.
Details on CVE-2026-73324
CVE-2026-73324 involves VLC’s RTSP access module and the potential exposure of heap memory to malicious servers. This vulnerability is described by CWE-125 (Out-of-bounds Read) and CWE-170 (Improper Null Termination).
The flaw arises when VLC processes RTSP response lines without appending a null terminator, leading to memory being read beyond allocated buffers. This can be exploited via a realrtsp URL in a playlist, potentially exposing sensitive memory data to a malicious RTSP server.
Importantly, the RTSP module’s presence in builds varies, but it is active in official VideoLAN distributions, affecting exposure levels.
Protective Measures and Recommendations
Users of VLC Media Player versions 3.0.0 to 3.0.23 should remain alert for updates from VideoLAN’s repositories and advisories. Until patches are available, it is advisable to avoid engaging with untrusted PNG files, media playlists, and RTSP streams.
Organizations should consider restricting VLC usage in high-risk settings, blocking untrusted RTSP connections, and employing endpoint monitoring to identify suspicious activities.
By staying informed and cautious, users and organizations can mitigate the risks posed by these vulnerabilities while awaiting a secure update.
