Security News VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

[Brownie2019]

Content source

https://gbhackers.com/vlc-media-player-flaws/

Two security vulnerabilities in VLC media player versions 3.0.0 through 3.0.23 could allow attackers to exploit heap memory issues. These vulnerabilities can be triggered by processing a malicious PNG file or connecting to attacker-controlled RealRTSP servers.

The more severe vulnerability, tracked as CVE-2026-56711, is a heap out-of-bounds write flaw with a CVSS v4 score of 8.6. This issue stems from an integer overflow in VLC’s picture buffer allocation logic, which occurs when the player processes a specially crafted PNG image.

VLC Media Player Flaws
The vulnerable routine, AllocatePicture, found in src/misc/picture.c, calculates the size needed for image planes by adding p->i_pitch multiplied by p->i_lines to a running allocation total.

Both variables are defined as 32-bit integer fields in include/vlc_picture.h, so the multiplication is performed with 32-bit arithmetic before the result is expanded into a size_t value.

An attacker can manipulate the PNG IHDR metadata by providing exceptionally large width and height values. This manipulation causes the multiplication to wrap to a smaller value, so aligned_alloc reserves an incorrectly sized heap buffer.

VLC’s PNG decoder then writes scanlines based on the original dimensions supplied by the attacker, allowing it to write beyond the allocated area.

Current checks do not prevent this condition. The pre-allocation overflow guard performs division using 64-bit arithmetic, while the subsequent limit check assesses the already wrapped allocation value.

The image demuxer also verifies the input file’s byte count instead of its declared image dimensions. Opening a malicious PNG directly or loading it from a playlist is sufficient to trigger the vulnerable processing path, and no special configuration is necessary.

Fabian Wahle from Hap Security credited this issue, which maps to CWE-190 (Integer Overflow or Wraparound) and CWE-787 (Out-of-bounds Write).

A separate medium-severity issue, CVE-2026-73324, impacts VLC’s handling of RealRTSP and carries a CVSS v4 score of 6.9. This bug is an out-of-bounds read caused by improper null termination in RTSP response processing.

In the RtspReadLine function, VLC copies response data to a fixed-size buffer using strncpy without ensuring that a terminating null byte is included.

If a hostile RTSP server returns a response line longer than 4,096 bytes, VLC later passes this unterminated buffer to strdup, which reads beyond its boundary until it encounters a stray null byte in adjacent heap memory.

An attacker can deliver the vulnerable line through the RTSP Session header. VLC then retains this data as a session identifier and sends it back to the server in later requests, potentially disclosing sensitive client data stored in heap memory to the malicious server.

The RealRTSP module is optional at build-time and may be disabled in certain distribution packages; however, it is enabled in official VideoLAN builds. Users should treat untrusted image files and RealRTSP playlist entries as potentially dangerous until VLC releases updated builds that address these issues.

 

[Bot]

Hi, this report describes plausible attack paths, but the quoted CVE details and claimed affected range are not backed here by a VideoLAN advisory or release note. So the sensible response is precaution—not declaring every VLC 3.0.0–3.0.23 installation confirmed vulnerable.

What the practical risk would be​

The PNG issue would require VLC to process a specially crafted image, either opened directly or reached through something such as a playlist. An out-of-bounds write can potentially cause a crash and, depending on exploitability and platform protections, code execution; the quoted description alone does not establish reliable code execution.

The RealRTSP issue requires VLC to connect to an attacker-controlled RTSP endpoint. An out-of-bounds read could expose adjacent process memory, but that does not mean an attacker can automatically dump arbitrary files, passwords, or all system memory. The optional-module point also means exposure may differ between official builds and distribution packages.

What users should do​

1. Check Help → About VLC and note the exact version and where the package came from.
2. Use VLC’s official update mechanism or the trusted operating-system repository. If a newer stable build is offered, install it rather than hunting for an unofficial patch.
3. Until VideoLAN confirms fixed versions, avoid opening unexpected PNG files, playlists, or `rtsp://` links in VLC—especially material delivered through email, chat, or unfamiliar websites.
4. Do not disable antivirus or operating-system exploit protections to make a suspicious file play.

Merely having VLC installed does not trigger either scenario. If someone only received or downloaded a file but did not open it in VLC, that is materially different from VLC actually processing it. Conversely, a crash while opening such content is not proof of exploitation, but it is a good reason to preserve the file without reopening it and submit the case for individualized analysis.

The missing confirmation​

Before treating the version range, CVSS scores, RealRTSP build status, and remediation status as settled facts, the decisive checks are an official VideoLAN security advisory and the corresponding release notes. The post does not identify a fixed release, so it would be premature to say that updating to any particular version resolves these two alleged flaws.