VLC Media Player has long enjoyed a reputation as the Swiss Army knife of digital media — a free, open-source application capable of playing just about anything a user throws at it. That versatility, however, also makes VLC an attractive target for attackers. On September 9, 2026, two VLC Media Player vulnerabilities were publicly disclosed that highlight the risks inherent in parsing untrusted media data. Tracked as CVE-2026-56711 and CVE-2026-73324, the flaws affect VLC versions 3.0.0 through 3.0.23 and can be triggered simply by persuading a victim to open a specially crafted media file or playlist entry. One issue corrupts heap memory through an integer overflow in the picture allocation path; the other leaks heap memory through an improperly terminated RTSP response line.
Two VLC Media Player Vulnerabilities, One Shared Risk: Memory Safety
Independent security researcher Fabian Wahle of Hap Security discovered both flaws. They were publicly disclosed on September 9, 2026, carrying severity ratings that reflect two very different threat profiles. CVE-2026-56711 is rated high severity with a CVSS score of 8.6 out of 10, while CVE-2026-73324 is rated medium severity with a CVSS score of 6.9. Despite their different scores, both vulnerabilities share a common root theme: VLC’s C-based codebase still relies on the kind of manual memory management that has produced security failures across decades of software development.
The two flaws also share a practical consequence. An attacker who can deliver a malicious file to a target’s desktop — or, in the RTSP case, simply point VLC at a hostile server — gains a foothold inside the player’s memory space. For a media player that may have access to personal media libraries, cached credentials, and other sensitive in-memory data, that foothold is not to be underestimated.
CVE-2026-56711: An Integer Overflow in Picture Allocation That Corrupts Heap Memory
CVE-2026-56711 is an integer overflow and out-of-bounds write vulnerability located in VLC’s picture-buffer allocation logic. The bug lives in the AllocatePicture function within src/misc/picture.c, which is responsible for determining how much memory the decoder needs for the image planes of a decoded frame.
The calculation itself looks innocent enough. VLC computes the total buffer size required for decoded image planes by adding together values derived from i_pitch * i_lines. Both i_pitch and i_lines are defined as signed integer fields in include/vlc_picture.h. The problem is that the multiplication takes place in 32-bit arithmetic. When a decoded image carries extremely large dimensions, the product of the two values exceeds what a 32-bit signed integer can represent, and the value wraps around. As a result, VLC may allocate a much smaller memory region than the decoder genuinely requires.
This is the essence of the integer overflow flaw, classified as CWE-190 (Integer Overflow or Wraparound). Once the undersized buffer is allocated, the succeeding out-of-bounds write, categorized as CWE-787 (Out-of-bounds Write), becomes unavoidable the moment the decoder starts writing image data into the buffer.
Why Existing Validation Fails to Stop the Overflow
VLC is not entirely without defenses. There are validation routines intended to reject images whose dimensions would produce excessive memory requirements. The researchers found, however, that both relevant checks can be bypassed.
One validation routine performs its division using 64-bit arithmetic, but it does not constrain the preceding 32-bit multiplication. The arithmetic overflow occurs before the check ever sees the true product; by the time the 64-bit division runs, it is examining a value that has already been truncated. The second check is even more telling: it evaluates the already-wrapped result, meaning that the malicious dimensions sail through validation precisely because the overflow has already reduced the computed value to something that looks harmless.
The takeaway is uncomfortable. VLC’s validation logic checks a number that has already been corrupted by the overflow, rather than checking the original attacker-controlled dimensions. It is a validation-ordering flaw as much as it is a memory safety flaw.
A Crafted PNG Is the Attack Vehicle
The practical exploitation path begins with a PNG image. PNG files contain an IHDR header, which declares the width and height of the image in pixels. A malicious PNG can declare extraordinarily large values in those fields. VLC’s image demuxer does perform at least one sanity check — it compares the declared dimensions against the input file size — but it does not properly validate the declared image dimensions themselves. In other words, a file that is physically small can legally declare itself to be a nearly infinite canvas.
When the PNG decoder begins processing scanlines based on the original attacker-controlled dimensions, it writes far more data into the heap buffer than the buffer can hold. The result is heap memory corruption, which can manifest as a crash or, in a more carefully arranged heap layout, as an opportunity for broader memory corruption.
What an Attacker Can Achieve
The severity of this vulnerability rests on the gap between two likely outcomes and one catastrophic one. The most probable outcomes are application instability and denial of service. But because heap corruption in a C application can sometimes be shaped into arbitrary code execution, the CVSS score of 8.6 reflects a threat model that anticipates an attacker with the skill and patience to exploit the corruption for more than a crash. Whether code execution is achievable depends heavily on the operating system’s memory hardening, the heap state at the moment of the overwrite, and the attacker’s ability to influence that state through repeated attempts.
CVE-2026-73324: An Unterminated RTSP Response Line Leaks Heap Memory
The second vulnerability, CVE-2026-73324, is a quieter but arguably more elegant problem. It affects VLC’s RTSP access module, which implements the Real Time Streaming Protocol used by many media servers to control streaming sessions. The flaw is classified as CWE-125 (Out-of-bounds Read) and CWE-170 (Improper Null Termination), and it exposes adjacent heap memory to a malicious RTSP server.
The root cause lies in the RtspReadLine function in modules/access/rtsp/access.c. The function relies on strncpy to copy a response line received from the server into a fixed-size buffer. strncpy is notorious for a specific behavior: if the source string is at least as long as the destination buffer, it copies up to the limit and does not append a null terminator. In this case, a server-controlled line that is at least 4096 bytes long leaves VLC holding a buffer with no terminating zero byte.
VLC later passes this unterminated buffer to strdup in modules/access/rtsp/rtsp.c. Since strdup expects a standard null-terminated C string, it continues reading beyond the allocated buffer, byte after byte, until it happens upon a zero value somewhere in the surrounding heap memory. The extra data read by strdup is treated as part of the string, which means VLC now holds a copy of memory contents it was never supposed to see.
The Exfiltration Channel: RTSP Session Headers
What elevates this from a memory read bug to an information disclosure is the way VLC uses the copied data. The vulnerable input is the RTSP Session header, which a server sends to establish a session identifier. VLC stores the copied data as that identifier and then sends it back to the server in subsequent RTSP requests.
An attacker who controls a malicious RTSP server can therefore set up a deliberate exfiltration loop. The server sends an oversized Session header; VLC reads past the end of the buffer into adjacent heap memory; VLC then dutifully transmits that memory back to the server in the session identifier field of the next request. The hostile server receives a stream of heap memory from the VLC client, scented with whatever sensitive data happens to live nearby in the process’s memory space. That could include URLs, tokens, credentials, or fragments of decrypted media data.
Triggering the Bug
Exploitation is refreshingly straightforward for an attacker. A malicious playlist containing a realrtsp URL can trigger the flaw when the victim simply opens the playlist. The RTSP module is optional at build time, which means not every VLC distribution is necessarily affected; Linux packages vary depending on the distro’s compile flags. However, RTSP support is enabled in official VideoLAN builds, so most users who downloaded VLC directly from the project’s own site are exposed.
Affected Versions and Practical Defense: What to Do Until Patches Arrive
Both vulnerabilities affect VLC Media Player versions 3.0.0 through 3.0.23. That is a broad sweep — essentially the entire lifespan of the VLC 3.0 series through late 2026. At the time of the September 9 disclosure, no patched release had been announced. Users should monitor VideoLAN’s official project repository and distribution-maintainer advisories for security updates and patched releases.
Immediate Mitigations for Individual Users
For individual users, the practical advice is straightforward but genuinely important: avoid opening PNG files, media playlists, and RTSP streams that come from untrusted sources. A PNG file is a particularly sneaky attack vector because images are so routinely shared and so rarely treated as dangerous. The RTSP issue is equally deceptive — a user might open a playlist from a new streaming site without considering that the realrtsp URL inside it is controlled by a hostile third party.
Enterprise Defenses
Organizations should take a more structured approach. Restricting VLC execution in high-risk environments reduces the likelihood that a malicious file reaches a privileged workstation. Blocking untrusted RTSP connections where practical cuts off the network-level vector entirely. Endpoint monitoring should be configured to detect suspicious media file drops, playlist downloads, and attempts to launch VLC with unusual arguments or from unexpected locations.
These measures are not permanent substitutes for a patch. They are, however, the difference between vulnerability and exploitation in the days and weeks before a fix becomes available.
Why Media Player Parsers Remain a Security Battleground
Neither of these vulnerabilities is exotic. Integer overflows and unterminated strings are among the oldest classes of memory safety bugs in the C programming canon. Their persistence inside VLC is a reminder that media players are an attack surface of exceptional depth. A modern media player ingests dozens of container formats, hundreds of codecs, and a sprawl of streaming protocols. Each of those parsers is a potential entry point, and each is subject to the same class of human error.
VLC’s popularity — it is one of the most widely installed media applications globally — magnifies the impact. An attacker needs to find only one serious flaw in one obscure parser to reach a massive installed base. The fact that CVE-2026-56711 exists in the core allocation path, something every decoded frame touches, is a sobering reminder of how much trust the ecosystem places in a codebase maintained by a relatively small group of contributors.
At the same time, the disclosure of these vulnerabilities is itself a sign of health. Independent researchers like Fabian Wahle and organizations like Hap Security continue to subject VLC to rigorous scrutiny, and the public disclosure process keeps the pressure to fix these issues visible. The open-source model cannot prevent every bug, but it does provide a channel for discovery and accountability that proprietary, closed-source players do not offer.
Answers to the Most Pressing Questions About the VLC Vulnerabilities
What is CVE-2026-56711? CVE-2026-56711 is a high-severity integer overflow and out-of-bounds write vulnerability in VLC Media Player’s picture-buffer allocation logic. It carries a CVSS score of 8.6, was discovered by Fabian Wahle of Hap Security, and was disclosed on September 9, 2026. An attacker can exploit it by crafting a PNG file with oversized dimensions, which leads to heap memory corruption and potentially arbitrary code execution.
How does CVE-2026-56711 corrupt heap memory? The AllocatePicture function multiplies 32-bit pitch and line-count values to compute the buffer size for decoded image planes. An image with extremely large dimensions causes the result to overflow and wrap around, so VLC allocates a buffer far smaller than the decoder actually needs. When the PNG decoder writes scanlines based on the original dimensions, it overruns the undersized buffer and corrupts adjacent heap memory.
What is CVE-2026-73324? CVE-2026-73324 is a medium-severity out-of-bounds read vulnerability in VLC’s RTSP access module, rated 6.9 on the CVSS scale. It occurs when the RtspReadLine function uses strncpy to copy a server-controlled response line into a fixed-size buffer without appending a null terminator when the line is at least 4096 bytes long. VLC then passes that unterminated buffer to strdup, which reads beyond the buffer and leaks adjacent heap memory to a malicious RTSP server.
How can VLC users protect themselves? Until a patched release is available, users should avoid opening PNG files, media playlists, and RTSP streams from untrusted sources. Organizations should restrict VLC execution in high-risk environments, block untrusted RTSP connections, and monitor endpoints for suspicious media file or playlist activity.
These two disclosures place VLC at an inflection point. The community that built the player’s reputation on reliability and format support must now apply that same energy to memory safety. The patches for CVE-2026-56711 and CVE-2026-73324 will arrive eventually, but the underlying lesson will not fade: a media player is only as trustworthy as the code that parses the untrusted files users hand it. Until VLC’s C-based parsers are hardened through systematic fixes, or are gradually replaced by memory-safe implementations, the responsibility for safety will continue to fall on the researchers who find these flaws, the users who must exercise caution, and the security teams who filter what reaches the desktop.
