VideoLAN: VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

Critical VLC Media Player Vulnerabilities Expose Users to Heap Exploitation

Two security flaws in VLC media player versions 3.0.0 through 3.0.23 could allow attackers to exploit heap memory vulnerabilities via malicious PNG files or attacker-controlled RealRTSP servers.

The more severe issue, CVE-2026-56711 (CVSS v4: 8.6), is a heap out-of-bounds write flaw caused by an integer overflow in VLC’s AllocatePicture function. When processing a specially crafted PNG file, manipulated IHDR metadata with oversized width and height values triggers a 32-bit arithmetic overflow, leading to an undersized heap buffer allocation. The PNG decoder then writes scanlines beyond the allocated memory, enabling potential code execution. The vulnerability, credited to Fabian Wahle of Hap Security, maps to CWE-190 (Integer Overflow) and CWE-787 (Out-of-Bounds Write).

A second, medium-severity flaw, CVE-2026-73324 (CVSS v4: 6.9), affects VLC’s RealRTSP handling. An improper null termination in the RtspReadLine function allows an attacker to send an oversized RTSP response (exceeding 4,096 bytes), causing strdup to read beyond the buffer and leak adjacent heap memory including sensitive client data to a malicious server. While the RealRTSP module is optional, it is enabled in official VideoLAN builds.

Both vulnerabilities require no special configuration to exploit. Users are exposed when opening malicious PNG files or connecting to untrusted RealRTSP servers. VideoLAN has yet to release patched versions.

Source: https://gbhackers.com/vlc-media-player-flaws/

VideoLAN TPRM report: https://www.rankiteo.com/company/videolan

"id": "vid1789129916",
"linkid": "videolan",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Users of VLC media player '
                                              'versions 3.0.0 through 3.0.23',
                        'industry': 'Technology',
                        'name': 'VideoLAN',
                        'type': 'Software Vendor'}],
 'attack_vector': ['Malicious PNG file', 'Attacker-controlled RealRTSP server'],
 'data_breach': {'data_exfiltration': 'Possible via RealRTSP vulnerability',
                 'sensitivity_of_data': 'High (potential sensitive client '
                                        'data)',
                 'type_of_data_compromised': 'Heap memory (sensitive client '
                                             'data)'},
 'description': 'Two security flaws in VLC media player versions 3.0.0 through '
                '3.0.23 could allow attackers to exploit heap memory '
                'vulnerabilities via malicious PNG files or '
                'attacker-controlled RealRTSP servers. The more severe issue, '
                'CVE-2026-56711 (CVSS v4: 8.6), is a heap out-of-bounds write '
                'flaw caused by an integer overflow in VLC’s AllocatePicture '
                'function. A second, medium-severity flaw, CVE-2026-73324 '
                '(CVSS v4: 6.9), affects VLC’s RealRTSP handling due to '
                'improper null termination in the RtspReadLine function.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
                                       'security flaws',
            'data_compromised': 'Sensitive client data (via heap memory leak)',
            'operational_impact': 'Potential code execution or data '
                                  'exfiltration',
            'systems_affected': 'VLC media player versions 3.0.0 through '
                                '3.0.23'},
 'post_incident_analysis': {'root_causes': ['Integer overflow in '
                                            'AllocatePicture function',
                                            'Improper null termination in '
                                            'RtspReadLine function']},
 'recommendations': 'Users should avoid opening untrusted PNG files or '
                    'connecting to untrusted RealRTSP servers until patches '
                    'are released.',
 'references': [{'source': 'Fabian Wahle (Hap Security)'}],
 'title': 'Critical VLC Media Player Vulnerabilities Expose Users to Heap '
          'Exploitation',
 'type': ['Heap Out-of-Bounds Write', 'Memory Leak'],
 'vulnerability_exploited': ['CVE-2026-56711', 'CVE-2026-73324']}