VLC flaws enable memory corruption and data leakage

Two newly disclosed vulnerabilities affecting VLC media player 3.0.0 through 3.0.23 can corrupt heap memory or expose data when users open a malicious PNG image or connect to an attacker-controlled RealRTSP server, security records published this week show.

The more serious issue, CVE-2026-56711, is an integer-overflow flaw in VLC’s picture-allocation logic that can lead to a heap out-of-bounds write. The vulnerability carries a CVSS v4 score of 8.6 and a CVSS v3.1 score of 8.8, placing it in the high-severity range.

The flaw arises when VLC calculates the size of a picture buffer using 32-bit arithmetic. Under certain dimensions, the multiplication used to determine the required memory size can wrap around to a smaller value. VLC then allocates an undersized buffer while the PNG decoder continues writing data based on the original image dimensions, allowing data to be written beyond the allocated heap region.

A specially crafted PNG file can trigger the condition by declaring very large width and height values in its IHDR image header. Opening such a file directly, or loading it through a playlist entry, is sufficient to reach the vulnerable code path without requiring non-default settings.

Security descriptions associated with the vulnerability say successful exploitation could cause memory corruption and may permit arbitrary code execution. The weakness has been classified under CWE-190, covering integer overflow or wraparound, and CWE-787, which covers out-of-bounds writes.

The CVE records were published on September 9 after the issues were assigned through the vulnerability disclosure process. CVE-2026-56711 is described as remotely reachable, requiring no privileges but requiring user interaction, because a victim must open or otherwise process the crafted content. Its CVSS v4 vector assigns high potential impact to confidentiality, integrity and availability. CVE-2026-73324 also requires user interaction and no privileges, but its assessed impact is concentrated on confidentiality because the flaw reads memory rather than writing to it or directly disrupting the application on the affected client.

The second vulnerability, CVE-2026-73324, affects VLC’s RealRTSP handling and can disclose portions of heap memory to a hostile streaming server. It has a CVSS v4 score of 6.9 and is rated medium severity.

That flaw stems from VLC copying an RTSP response line into a fixed-size buffer without ensuring that the copied string is terminated with a null byte. When a server returns a Session header line of 4,096 bytes or more, a subsequent string-handling operation can continue reading beyond the end of the allocated buffer until it encounters a zero byte elsewhere in memory.

The extra bytes can then become part of the session identifier that VLC sends back to the server in later requests. This means an attacker operating the RealRTSP server could receive adjacent heap contents from the VLC client, creating a direct information-disclosure route rather than merely causing a crash.

A playlist entry pointing to a malicious realrtsp URL is enough to reach the vulnerable module where that feature is enabled. Security records note that RealRTSP support is a build-time option: it is enabled in official VideoLAN builds but disabled in some distribution packages, limiting exposure on systems where the component is absent.

Both flaws affect versions from VLC 3.0.0 through 3.0.23. VideoLAN’s public download pages continued to list version 3.0.23 as the current VLC 3.0 release on Friday, while its security bulletin index had not listed a dedicated advisory for these two 2026 CVEs.

Ubuntu’s security tracker, updated on September 10, classified both vulnerabilities as medium priority for its VLC packages and marked supported releases as needing evaluation. That assessment reflects distribution-specific packaging and does not alter the higher technical severity assigned to CVE-2026-56711 by the vulnerability records.

The disclosures underline the risk posed by media-processing software, where files and network responses are parsed automatically by complex codec and protocol code. Attackers can exploit mistakes in memory-size calculations or string handling before the user sees ordinary playback behaviour.