Two security vulnerabilities in VLC Media Player could enable attackers to corrupt memory or extract sensitive data from affected systems by persuading users to open a specially crafted image file or media playlist.
The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC versions 3.0.0 through 3.0.23 and were disclosed on September 9, 2026.
The more severe issue, CVE-2026-56711, is a high-severity heap out-of-bounds write vulnerability with a CVSS v4 score of 8.6.
VLC Media Player Flaws
Security researcher Fabian Wahle of Hap Security identified the flaw in VLC’s picture-buffer allocation logic, where the application calculates the memory required to process image data.
VLC uses 32-bit integer arithmetic while accumulating picture-plane sizes in the AllocatePicture function within src/misc/picture.c. The calculation adds the product of each plane’s pitch and number of lines to a running total.
Because the relevant values are stored as signed int fields, the multiplication can overflow and wrap to a much smaller value before the result is expanded into the larger size_t allocation variable.
As a result, VLC can reserve a small heap buffer even though the decoder later handles image dimensions that require substantially more memory.
Existing checks do not reliably stop the condition because one validates values in 64-bit arithmetic while the vulnerable multiplication occurs at 32 bits. A later size comparison also evaluates the already wrapped value rather than the original oversized result.
An attacker could exploit the issue with a malicious PNG image containing extremely large width and height values in its IHDR header. VLC’s image demuxer checks the input file’s byte size but does not adequately constrain the declared image dimensions.
When VLC decodes the crafted PNG, it may write scanline data beyond the allocated heap buffer using attacker-controlled content and lengths.
Opening the image directly in VLC, or loading it through a playlist entry, is sufficient to reach the vulnerable code path. No non-default configuration is required.
Heap out-of-bounds writes are particularly serious because they can cause crashes, data corruption, and, depending on memory layout and exploit mitigations, potentially enable arbitrary code execution.
The second flaw, CVE-2026-73324, is a medium-severity heap out-of-bounds read with a CVSS v4 score of 6.9. It affects VLC’s optional RealRTSP handling module, which is enabled in official VideoLAN builds but may be disabled in some distribution-packaged versions.
The bug stems from the RtspReadLine function copying a server response line into a fixed-size buffer with strncpy without ensuring a terminating null byte.
If a malicious RealRTSP server sends a Session header line of at least 4,096 bytes, VLC later passes the unterminated buffer to strdup. The function then reads beyond the allocated heap memory until it encounters an incidental null byte.
Crucially, the resulting adjacent heap data can be retained as a session identifier and transmitted back to the attacker-controlled RTSP server during subsequent requests. This turns the memory disclosure into direct data exfiltration rather than a purely local crash.
Organizations and users running VLC 3.0.0 through 3.0.23 should treat untrusted PNG files, playlists, and RealRTSP links cautiously until an updated release or vendor remediation is available.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
