VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

Two security vulnerabilities in VLC media player versions 3.0.0 through 3.0.23 could allow attackers to exploit heap memory issues. These vulnerabilities can be triggered by processing a malicious PNG file or connecting to attacker-controlled RealRTSP servers.

The more severe vulnerability, tracked as CVE-2026-56711, is a heap out-of-bounds write flaw with a CVSS v4 score of 8.6. This issue stems from an integer overflow in VLC’s picture buffer allocation logic, which occurs when the player processes a specially crafted PNG image.

VLC Media Player Flaws

The vulnerable routine, AllocatePicture, found in src/misc/picture.c, calculates the size needed for image planes by adding p->i_pitch multiplied by p->i_lines to a running allocation total.

Both variables are defined as 32-bit integer fields in include/vlc_picture.h, so the multiplication is performed with 32-bit arithmetic before the result is expanded into a size_t value.

An attacker can manipulate the PNG IHDR metadata by providing exceptionally large width and height values. This manipulation causes the multiplication to wrap to a smaller value, so aligned_alloc reserves an incorrectly sized heap buffer.

VLC’s PNG decoder then writes scanlines based on the original dimensions supplied by the attacker, allowing it to write beyond the allocated area.

Current checks do not prevent this condition. The pre-allocation overflow guard performs division using 64-bit arithmetic, while the subsequent limit check assesses the already wrapped allocation value.

The image demuxer also verifies the input file’s byte count instead of its declared image dimensions. Opening a malicious PNG directly or loading it from a playlist is sufficient to trigger the vulnerable processing path, and no special configuration is necessary.

Fabian Wahle from Hap Security credited this issue, which maps to CWE-190 (Integer Overflow or Wraparound) and CWE-787 (Out-of-bounds Write).

A separate medium-severity issue, CVE-2026-73324, impacts VLC’s handling of RealRTSP and carries a CVSS v4 score of 6.9. This bug is an out-of-bounds read caused by improper null termination in RTSP response processing.

In the RtspReadLine function, VLC copies response data to a fixed-size buffer using strncpy without ensuring that a terminating null byte is included.

If a hostile RTSP server returns a response line longer than 4,096 bytes, VLC later passes this unterminated buffer to strdup, which reads beyond its boundary until it encounters a stray null byte in adjacent heap memory.

An attacker can deliver the vulnerable line through the RTSP Session header. VLC then retains this data as a session identifier and sends it back to the server in later requests, potentially disclosing sensitive client data stored in heap memory to the malicious server.

The RealRTSP module is optional at build-time and may be disabled in certain distribution packages; however, it is enabled in official VideoLAN builds. Users should treat untrusted image files and RealRTSP playlist entries as potentially dangerous until VLC releases updated builds that address these issues.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.