Loading story…
Two vulnerabilities affecting VLC Media Player versions 3.0.0 through 3.0.23 allow attacker-controlled media content to corrupt heap memory or expose client memory. High-severity CVE-2026-56711, discovered by Fabian Wahle of Hap Security, is an integer-overflow and out-of-bounds-write flaw in picture-buffer allocation that can be triggered with an oversized crafted PNG image; successful exploitation may lead to heap corruption and potentially code execution.
Medium-severity CVE-2026-73324 affects RTSP response parsing: a malicious RTSP server, including one reached through a crafted playlist, can provide an overlong Session header and retrieve adjacent heap memory. VideoLAN and distribution maintainers had not yet provided patched releases, so users should avoid untrusted PNG files, playlists, and RTSP streams; organizations should limit VLC use in high-risk workflows and block untrusted RTSP connections where practical.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Fabian Wahle of Hap Security disclosed CVE-2026-56711, a high-severity picture-buffer integer-overflow/out-of-bounds-write flaw, and CVE-2026-73324, a medium-severity RTSP out-of-bounds-read flaw. Both affect VLC Media Player versions 3.0.0 through 3.0.23 and can be triggered through attacker-controlled media content or RTSP responses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cert.aikt.rs
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-33848** and **CVE-2026-33849**, were disclosed in **LinkingVision rapidvms**, both classified as **CWE-119** improper restriction of operations within the bounds of a memory buffer. The flaws affect **rapidvms versions before `PR#96`** and carry the same **CVSS v3.1** vector, `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating network-reachable exploitation with low attack complexity, no required privileges, user interaction, and potential for high impact across confidentiality, integrity, and availability. Both CVE records point to **GitHub pull request `#96`** in the `linkingvision/rapidvms` repository as the referenced fix or related remediation. Organizations running vulnerable rapidvms builds should review the changes in that pull request, identify any exposed instances, and prioritize upgrading or patching affected systems because successful exploitation could lead to severe compromise of the video management platform.
Jun 29, 2026
Cisco Talos disclosed four heap-based buffer overflow vulnerabilities in the MediaArea **MediaInfoLib** library affecting version `26.01`. The flaws, tracked as `CVE-2026-25104`, `CVE-2026-25713`, `CVE-2026-28764`, and `CVE-2026-22554`, were discovered by Dimitrios Tatsis and mapped by Talos to `TALOS-2026-2367`, `TALOS-2026-2368`, `TALOS-2026-2371`, and `TALOS-2026-2374`. Talos said the vulnerabilities can be triggered when an attacker supplies a specially crafted media file, potentially leading to arbitrary code execution in affected environments. MediaArea has patched the issues under Cisco’s third-party vulnerability disclosure process, and Talos said updated **Snort** rule sets are available to help defenders detect exploitation attempts targeting the library.
Jun 29, 2026
A high-severity vulnerability tracked as **CVE-2026-58049** affects FFmpeg’s RASC video decoder in `libavcodec/rasc.c`, where the `decode_dlta()` function performs 32-bit reads and writes before enforcing a row-boundary check. The flaw is compounded by validating the DLTA region in pixel units rather than byte units, allowing a crafted media stream using the RASC FourCC to access several bytes past a PAL8 frame row allocation. Security advisories say the bug can trigger a bitstream-controlled heap out-of-bounds write and an adjacent out-of-bounds read during decoding, leading to memory corruption and potential remote exploitation. A public proof of concept demonstrates the issue on FFmpeg upstream code and shows how DLTA run handlers can write past a 64-byte PAL8 frame row boundary. The PoC uses a custom buffer callback to place a function pointer next to the frame buffer, then overwrites the low bytes of that pointer through a crafted DLTA run to redirect execution, while AddressSanitizer reports a heap-buffer-overflow in `decode_dlta()`. Reported mitigations include updating FFmpeg, applying vendor patches, and moving row-boundary validation ahead of every 32-bit access with stricter checks such as ensuring `cx + 4 <= w * s->bpp`.
Jul 12, 2026