Do Son 
TL;DR
Two VLC media player vulnerabilities let attackers corrupt or read heap memory. One triggers on a crafted PNG file. The other triggers when VLC connects to a malicious RTSP server. No patch is available yet.
- Product: VideoLAN VLC media player
- Vulnerabilities: 2 flaws (CVE-2026-56711, CVE-2026-73324)
- Highest severity: 8.8 (High · CVSSv3)
- Worst impact: 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-56711 | 8.8 | 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation | Not exploited |
| CVE-2026-73324 | 6.5 | 3.0.0 through 3.0.23 Heap Out-of-Bounds Read via Unterminated RealRTSP Response Line | Not exploited |
Why these VLC media player vulnerabilities matter
VLC ships on hundreds of millions of desktops worldwide. A single booby-trapped file could reach that huge install base. These VLC media player vulnerabilities need only that a user opens attacker-supplied media.
The more severe flaw, CVE-2026-56711, carries a CVSS score of 8.6. It allows a heap out-of-bounds write. The second, CVE-2026-73324, rates 6.9 and leaks heap memory to a remote server.
How the attacks work
Crafted PNG write
CVE-2026-56711 stems from 32-bit math during picture allocation. A crafted PNG declares huge width and height values. The size calculation wraps, so VLC reserves a tiny buffer. The decoder then writes full-sized scanlines past that buffer. Simply opening the file, even from a playlist, is enough.
Malicious RTSP read
CVE-2026-73324 abuses an unterminated RTSP response line. A hostile server returns a very long line, so VLC reads adjacent heap bytes. Those leaked bytes become the session identifier. The client then sends them back on every request. As a result, the server operator reads client memory directly.
Affected versions
Both flaws affect VLC media player 3.0.0 through 3.0.23. The RTSP module is a build-time option. Official VideoLAN builds enable it, though some distribution packages disable it.
Exploitation status
VulnCheck published advisories for both issues. To date, no in-the-wild exploitation or public proof-of-concept has been confirmed.
Patch and mitigation steps
No official patch exists at the time of writing. Until one ships, avoid opening untrusted media files. Also avoid RTSP streams from unknown sources. Review the technical details in VulnCheck’s advisories on the PNG heap write flaw and the RealRTSP heap read flaw. Watch VideoLAN channels for an updated release.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
