Two newly disclosed vulnerabilities in VLC Media Player could allow attackers to corrupt heap memory or read sensitive data from it.
What the Flaws Are
The first bug, tracked as CVE-2026-56711, is a high-severity issue (CVSS 8.6) that involves integer overflow and out-of-bounds writes in VLC’s picture buffer allocation system. Specifically, when decoding images, VLC multiplies ‘i_pitch’ by ‘i_lines’—both signed 32-bit integers. If a crafted image specifies huge dimensions (such as width and height in a PNG file’s IHDR header), the multiplication can overflow, wrapping to a much smaller value. Because some checks occur later using 64-bit arithmetic, they fail to catch the overflow early. When VLC’s PNG decoder later processes scanlines based on the original large dimensions, they write beyond the allocated buffer, which can lead to heap corruption, app crashes, or even arbitrary code execution depending on system protections.
The second vulnerability, CVE-2026-73324, is rated medium (CVSS 6.9). It affects the RTSP (Real Time Streaming Protocol) module in VLC and can expose heap memory through out-of-bounds reads. The root cause lies in a function that uses strncpy to copy server-controlled lines into a fixed-size buffer. If the line is 4096 bytes or longer, no null terminator gets appended. Later, VLC passes this unterminated buffer to strdup, which keeps reading memory past the buffer’s end looking for a null byte. A malicious RTSP server can exploit this via the Session header, letting it harvest memory contents from the VLC client. Some builds of VLC may not include the vulnerable RTSP access module, but it is enabled in official VideoLAN builds.
Affected Versions and How to Stay Safe
Both flaws impact VLC versions 3.0.0 through 3.0.23. They were publicly disclosed on September 9, 2026, thanks to research by Fabian Wahle of Hap Security.
Until patched versions are available, users are advised to avoid opening untrusted PNG images, media playlists, or RTSP streams. Organizations should also restrict VLC usage in environments that process untrusted media, block dubious RTSP connections when feasible, and monitor for suspicious playlist files.
These flaws underscore how even fundamental components like media players can harbor dangerous bugs. With image size math and input validation often providing fertile ground for security issues, this serves as a reminder for developers to apply secure coding practices everywhere. Users and system administrators should watch closely for patched VLC versions and security alerts — staying behind on this could expose media systems to serious risk.
