Loading vulnerability…
Heap Memory Disclosure in VLC RealRTSP Response Parsing
CVE-2026-73324 is an improper null-termination vulnerability affecting certain VLC media player builds from versions 3.0.0 through 3.0.23 that include the optional RealRTSP access module. RtspReadLine uses strncpy to copy an RTSP response line into a fixed-size 4,096-byte buffer without guaranteeing null termination. A malicious RTSP server can supply an overlong Session header, causing subsequent strdup processing to read beyond the buffer until a null byte is encountered. VLC stores the resulting string as its session identifier and sends it to the server in subsequent requests, disclosing adjacent process heap memory. Exploitation requires VLC to process an attacker-controlled stream, typically after a user opens a malicious stream or playlist. Exposure depends on build configuration.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises confidentiality by disclosing a limited, memory-layout-dependent portion of VLC process heap memory to an attacker-controlled RTSP server. Disclosed data may include pointers, heap metadata, previously decoded media fragments, or other runtime information. The contaminated session identifier can be transmitted repeatedly while the connection persists. Arbitrary code execution, integrity compromise, and denial of service are not established impacts of this specific vulnerability.
If you can’t patch tonight, do this now.
Disable or exclude the RealRTSP access module where it is unnecessary, or use a package built without it. Avoid untrusted playlists and RTSP streams, restrict outbound RTSP connectivity to trusted servers, and validate sources used by automated playback systems. Sandboxing VLC can reduce broader exposure but does not prevent disclosure of memory already held by the VLC process.
Patch, then assume compromise.
Install the applicable vendor security update for VLC and its affected packages. Debian 13 fixes are available in version 3.0.24-0+deb13u1, and Debian 12 fixes are available in version 3.0.24-0+deb12u1; later Debian security updates are also suitable. Fedora 43 identifies vlc-3.0.24-1.fc43 as the security update; Fedora 44 users should apply the update associated with advisory FEDORA-2026-ad90eab763. For source-maintained deployments, ensure RTSP response-line buffers are explicitly null-terminated before C-string operations and enforce appropriate header-length handling.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.