Loading story…
VLC Media Player users on Windows 11 have reported severe delays when opening MP3 files, with playback in some cases taking up to 33 seconds to start. VLC developers said the problem appeared after a recent Windows 11 update and traced it to Microsoft Defender incorrectly quarantining or blocking VLC's plugin cache rather than to a compromise or flaw in VLC itself. Because VLC depends on that cache to quickly load codecs, demuxers, and I/O modules, the player may be forced to rescan plugins before audio can begin.
VideoLAN and media reports said affected users may be able to restore normal behavior by reinstalling VLC, regenerating the cache, or adding VLC to Microsoft Defender exclusions. The recommended cache reset command is:
vlc --reset-plugins-cache
Microsoft had not publicly commented on the reports, and at least one publication said it was unable to reproduce the issue on its own Windows 11 test system.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Reports recommended regenerating VLC's plugin cache, including via the reset utility or reinstalling VLC, and adding VLC or its installation folder to Microsoft Defender exclusions. One cited workaround was running "vlc --reset-plugins-cache" to restore normal behavior.
VLC developers said the player itself was not primarily at fault and blamed a Microsoft Defender bug introduced through a Windows 11 update. They said Defender's interference with VLC's plugins.dat cache file was responsible for startup delays of up to 33 seconds on some systems.
The issue gained public attention after game developer Jonathan Blow said he had stopped using VLC in favor of Microsoft's Media Player because of the delay when playing MP3 files. His comments helped surface the problem more broadly.
After a recent Windows 11 update, Microsoft Defender reportedly began quarantining or blocking VLC's plugin cache on some Windows 11 systems. This caused VLC to rescan plugins and led to playback problems or delays when opening MP3 files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two vulnerabilities affecting VLC Media Player versions `3.0.0` through `3.0.23` allow attacker-controlled media content to corrupt heap memory or expose client memory. High-severity `CVE-2026-56711`, discovered by Fabian Wahle of Hap Security, is an integer-overflow and out-of-bounds-write flaw in picture-buffer allocation that can be triggered with an oversized crafted PNG image; successful exploitation may lead to heap corruption and potentially code execution. Medium-severity `CVE-2026-73324` affects RTSP response parsing: a malicious RTSP server, including one reached through a crafted playlist, can provide an overlong `Session` header and retrieve adjacent heap memory. VideoLAN and distribution maintainers had not yet provided patched releases, so users should avoid untrusted PNG files, playlists, and RTSP streams; organizations should limit VLC use in high-risk workflows and block untrusted RTSP connections where practical.
Sep 14, 2026
VideoLAN released **VLC Media Player 3.0.24**, remediating more than 130 security flaws across VLC and its bundled components. The update refreshes 49 third-party libraries, most notably replacing the embedded FFmpeg 4.4 branch with **FFmpeg 8.1.2**; one report attributes 49 fixed vulnerabilities directly to the VLC release. Users should update promptly, while detailed vulnerability advisories are expected on VideoLAN's security page. The release also adds ATRAC3/ATRAC9 audio decoding, APV video support, CEA-708 captions, improved MP4 and MPEG transport-stream metadata handling, SFTP public-key authentication, SMB2 support, and SRT listener-mode socket reuse. It further fixes Windows startup delays associated with daylight-saving-time changes, Direct3D11 rendering problems, Windows audio crashes, and AudioToolbox MIDI-synthesizer crashes on macOS 26 and later.
Sep 26, 2026
Microsoft confirmed that September Windows 11 security updates **KB5124008** and **KB5124012** can disable USB Audio Class 1.0 devices on Windows 11 24H2 and later systems. Affected devices may fail to start with Device Manager error `Code 10`, produce no sound, and leave volume controls or Sound settings unresponsive; microphones, 3D audio, and multichannel configurations are also affected. Organizations have reported that changing multichannel devices to 2-channel mode can restore service, but Microsoft has not released a permanent fix. KB5124008, which advances Windows 11 25H2 and 24H2 systems to builds 26200.9445 and 26100.9445, respectively, has also been confirmed to disrupt applications using HCS-managed Linux VMs with Plan9 shared folders, including Anthropic Claude Cowork workspace access, and to cause Remote Desktop Services instability. Additional reports cite Explorer crashes or black screens in virtual-desktop and profile-container deployments, File History failures with external drives, and AMD Radeon driver timeouts. Microsoft is investigating the issues; enterprises should test the updates against USB audio, VDI, RDS, Linux VM, backup, and AMD-dependent workflows while weighing mitigations against the updates' security fixes.
Sep 16, 2026