Two security vulnerabilities in VLC Media Player could allow attackers to corrupt heap memory or disclose sensitive data from a victim’s memory.
The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC Media Player versions 3.0.0 through 3.0.23 and require a victim to open a specially crafted media file or playlist entry.
Fabian Wahle of Hap Security discovered the vulnerabilities. CVE-2026-56711 carries a high severity rating with a CVSS score of 8.6, while CVE-2026-73324 is rated medium severity with a CVSS score of 6.9. Both issues were disclosed on September 9, 2026.
CVE-2026-56711 is an integer overflow and out-of-bounds write vulnerability in VLC’s picture-buffer allocation logic. The flaw is associated with CWE-190, Integer Overflow or Wraparound, and CWE-787, Out-of-bounds Write.
The issue exists in the AllocatePicture function within VLC’s src/misc/picture.c component. VLC calculates the total buffer size required for decoded image planes by adding values derived from i_pitch * i_lines. Both values are defined as signed int fields in include/vlc_picture.h.
Because the multiplication uses 32-bit arithmetic, a malicious image with extremely large dimensions can cause the calculated value to wrap around. VLC may then allocate a much smaller memory region than the decoder actually needs.
Existing checks do not adequately prevent the condition. One validation routine performs division using 64-bit arithmetic, but it does not constrain the preceding 32-bit multiplication. Another check evaluates the already-wrapped result, allowing the malicious dimensions to pass validation.
An attacker can exploit the flaw using a crafted PNG image with oversized width and height values in its IHDR header. VLC’s image demuxer checks the input file size but does not properly validate declared image dimensions.
When the PNG decoder processes scanlines based on the original attacker-controlled dimensions, it writes beyond the small allocated heap buffer.
Successful exploitation could cause heap memory corruption, application crashes, or potentially arbitrary code execution, depending on the memory layout and platform protections.
CVE-2026-73324 affects VLC’s RTSP access module and can expose heap memory to a malicious RTSP server. The vulnerability is classified as CWE-125 (Out-of-bounds Read) and CWE-170 (Improper Null Termination).
The bug occurs when VLC reads RTSP response lines in modules/access/rtsp/access.c. The RtspReadLine function uses strncpy to copy a response line into a fixed-size buffer. However, if the server-controlled line is at least 4096 bytes long, strncpy does not append a null terminator.
VLC later passes this unterminated buffer to strdup in modules/access/rtsp/rtsp.c. Since strdup expects a null-terminated C string, it continues reading memory beyond the allocated buffer until it finds a zero byte.
The vulnerable input is the RTSP Session header. VLC stores the copied data as a session identifier and sends it back to the RTSP server in later requests. This behavior gives a hostile server a direct way to receive adjacent heap memory from the VLC client.
A malicious playlist containing a realrtsp URL can trigger the flaw when the victim opens it. The RTSP module is optional at build time, meaning exposure may vary between Linux distribution packages. However, it is enabled in official VideoLAN builds.
The vulnerabilities affect VLC Media Player versions 3.0.0 through 3.0.23. Users should monitor VideoLAN’s official project repository and distribution-maintainer advisories for security updates and patched releases.
Until fixes are available, users should avoid opening PNG files, media playlists, and RTSP streams received from untrusted sources. Organizations should also restrict VLC execution in high-risk environments, block untrusted RTSP connections where practical, and use endpoint monitoring to detect suspicious media files or playlist-based delivery attempts.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
