VLC Media Player Bugs Expose Users to Remote Code Execution

Key Takeaways

• Two critical vulnerabilities, CVE-2026-56711 and CVE-2026-73324, have been discovered in VLC Media Player.
• These flaws could lead to heap memory corruption, sensitive data disclosure, or potentially remote code execution.
• VLC Media Player versions 3.0.0 through 3.0.23 are affected.
• Exploitation requires a victim to open a specially crafted media file or playlist.
• Users are advised to update VLC Media Player as soon as patches are released and exercise caution with untrusted media.

Critical Vulnerabilities Discovered in VLC Media Player

VLC Media Player, a widely used open-source multimedia player, is currently impacted by two significant security vulnerabilities. These flaws could enable attackers to corrupt heap memory, leading to application crashes or potentially remote code execution, or to disclose sensitive data directly from a victim’s memory.

Identified as CVE-2026-56711 and CVE-2026-73324, the vulnerabilities specifically target VLC Media Player versions ranging from 3.0.0 up to and including 3.0.23. Successful exploitation hinges on a victim opening a malicious media file or a specially crafted playlist entry.

Fabian Wahle of Hap Security is credited with the discovery of these vulnerabilities. CVE-2026-56711 has been assigned a high severity rating with a CVSS score of 8.6, while CVE-2026-73324 carries a medium severity rating with a CVSS score of 6.9. Both issues were publicly disclosed on September 9, 2026.

Heap Out-of-Bounds Write via Integer Overflow (CVE-2026-56711)

CVE-2026-56711 is an integer overflow and subsequent out-of-bounds write vulnerability. This flaw resides within VLC’s picture-buffer allocation logic and is associated with CWE-190 (Integer Overflow or Wraparound) and CWE-787 (Out-of-bounds Write).

The core of this vulnerability lies in the AllocatePicture function within VLC’s src/misc/picture.c component. VLC calculates the total buffer size needed for decoded image planes by summing values derived from i_pitch * i_lines. Both i_pitch and i_lines are defined as signed integer fields in include/vlc_picture.h.

Due to the use of 32-bit arithmetic for this multiplication, an attacker can craft a malicious image with excessively large dimensions. This can cause the calculated value to wrap around, resulting in VLC allocating a significantly smaller memory region than the decoder actually requires.

Existing validation mechanisms fail to adequately prevent this condition. One check employs 64-bit arithmetic for division but does not constrain the preceding 32-bit multiplication. Another check evaluates the already-wrapped result, allowing the malicious dimensions to bypass validation entirely.

Attackers can exploit this flaw by embedding oversized width and height values into the IHDR header of a crafted PNG image. While VLC’s image demuxer checks the input file size, it does not properly validate the declared image dimensions.

When the PNG decoder attempts to process scanlines based on these attacker-controlled dimensions, it performs writes beyond the boundaries of the undersized allocated heap buffer. Successful exploitation could lead to heap memory corruption, application crashes, or, depending on memory layout and platform protections, potentially arbitrary code execution.

Heap Out-of-Bounds Read via Unterminated RTSP Response (CVE-2026-73324)

CVE-2026-73324 affects VLC’s RTSP (Real-Time Streaming Protocol) access module, potentially exposing heap memory to a malicious RTSP server. This vulnerability is categorized under CWE-125 (Out-of-bounds Read) and CWE-170 (Improper Null Termination).

The bug manifests when VLC processes RTSP response lines within modules/access/rtsp/access.c. The RtspReadLine function uses strncpy to copy a response line into a fixed-size buffer. However, if the server-controlled line is 4096 bytes or longer, strncpy fails to append a null terminator.

Subsequently, VLC passes this non-null-terminated buffer to strdup in modules/access/rtsp/rtsp.c. Since strdup expects a null-terminated C string, it continues reading memory beyond the allocated buffer until it encounters a null byte.

The vulnerable input is the RTSP Session header. VLC stores this copied data as a session identifier and then transmits it back to the RTSP server in subsequent requests. This behavior provides a hostile server with a direct channel to receive adjacent heap memory contents from the unsuspecting VLC client.

A malicious playlist containing a realrtsp URL can trigger this flaw when a victim opens it. While the RTSP module is optional at build time, meaning exposure may vary across different Linux distribution packages, it is enabled in official VideoLAN builds. The vulnerabilities affect VLC Media Player versions 3.0.0 through 3.0.23.

What You Should Do

• Monitor for Updates: Users should regularly check VideoLAN’s official project repository and their distribution-maintainer advisories for security updates and patched releases.
• Avoid Untrusted Media: Until official fixes are available, refrain from opening PNG files, media playlists, or RTSP streams from untrusted or unverified sources.
• Restrict Execution: In high-risk environments, organizations should consider restricting VLC execution and blocking untrusted RTSP connections where feasible.
• Endpoint Monitoring: Implement and utilize endpoint monitoring solutions to detect any suspicious media files or playlist-based delivery attempts that might exploit these vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.