endpoint-software-vulnerabilityproof-of-concept-release

VLC Flaws Enable Heap Corruption and Memory Disclosure Through Media Content

Vulnerability Disclosure · 3 sources · Updated 2mo ago · First seen Sep 12, 2026

Two vulnerabilities affecting VLC Media Player versions 3.0.0 through 3.0.23 allow attacker-controlled media content to corrupt heap memory or expose client memory. High-severity CVE-2026-56711, discovered by Fabian Wahle of Hap Security, is an integer-overflow and out-of-bounds-write flaw in picture-buffer allocation that can be triggered with an oversized crafted PNG image; successful exploitation may lead to heap corruption and potentially code execution.

Medium-severity CVE-2026-73324 affects RTSP response parsing: a malicious RTSP server, including one reached through a crafted playlist, can provide an overlong Session header and retrieve adjacent heap memory. VideoLAN and distribution maintainers had not yet provided patched releases, so users should avoid untrusted PNG files, playlists, and RTSP streams; organizations should limit VLC use in high-risk workflows and block untrusted RTSP connections where practical.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

1 event · Sep 9, 2026

Sep 9, 20262mo ago
Two VLC heap-memory vulnerabilities disclosed
Fabian Wahle of Hap Security disclosed CVE-2026-56711, a high-severity picture-buffer integer-overflow/out-of-bounds-write flaw, and CVE-2026-73324, a medium-severity RTSP out-of-bounds-read flaw. Both affect VLC Media Player versions 3.0.0 through 3.0.23 and can be triggered through attacker-controlled media content or RTSP responses.
Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Integer Overflow and Heap Buffer Overflow in VLC Picture Allocation (CVE-2026-56711)Heap Memory Disclosure in VLC RealRTSP Response Parsing (CVE-2026-73324)

Affected products

1 linked

Vlc Media Player

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cert Rs AiktAdvisories · Sep 14, 2026

Višestruke ranjivosti u VLC Media Playeru omogućavaju oštećenje ili čitanje memorije - CERT RSOpen source ↗

Cyber Security NewsNews · Sep 12, 2026

Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap MemoryOpen source ↗

Cryptika BlogNews · Sep 12, 2026

Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory | Cryptika CybersecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

VLC Flaws Enable Heap Corruption and Memory Disclosure Through Media Content

How this story unfolded

Two VLC heap-memory vulnerabilities disclosed

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Two High-Severity Buffer Overflow Flaws Disclosed in LinkingVision rapidvms

Four MediaInfoLib Heap Overflows Enable Code Execution via Malicious Media Files

FFmpeg RASC Decoder Flaw Enables Heap Out-of-Bounds Write via Crafted Media

VLC Flaws Enable Heap Corruption and Memory Disclosure Through Media Content

How this story unfolded

Two VLC heap-memory vulnerabilities disclosed

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Two High-Severity Buffer Overflow Flaws Disclosed in LinkingVision rapidvms

Four MediaInfoLib Heap Overflows Enable Code Execution via Malicious Media Files

FFmpeg RASC Decoder Flaw Enables Heap Out-of-Bounds Write via Crafted Media