VLC Media Player: Integer Overflow in AllocatePicture (CVE-2026-56711) and RTSP Heap Out-of-Bounds Read (CVE-2026-73324)

VLC Media Player (TL-2026-2464) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-09-12. It has no confirmed attribution, affects VideoLAN VLC media player, references 2 CVEs (CVE-2026-56711, CVE-2026-73324), maps to 9 MITRE ATT&CK techniques (T1071, T1203, T1204.001), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-2464

Threat ID
TL-2026-2464
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-12
Last reviewed
2026-09-12
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
17

Two memory-safety flaws disclosed 2026-09-09 in VLC Media Player 3.0.0 through 3.0.23: a 32-bit integer-overflow/heap out-of-bounds write in the picture-buffer allocator (AllocatePicture) triggerable via a crafted PNG's oversized IHDR dimensions, and a heap out-of-bounds read in the RealRTSP access module (RtspReadLine/strdup) triggerable by a malicious RTSP server sending an unterminated response line. Both require user interaction (opening a crafted file/playlist or connecting to an attacker-controlled RTSP stream); no patch is available as of 2026-09-12.

How VLC Media Player works

CVE-2026-56711 (heap out-of-bounds write, CWE-190/CWE-787, NVD CVSS 3.1 base 8.8: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; CVSS 4.0 base 8.6: AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) lives in AllocatePicture in src/misc/picture.c. VLC computes the buffer size needed for a decoded image plane by accumulating i_bytes += p->i_pitch * p->i_lines, both plane_t fields declared as signed int in include/vlc_picture.h, so the multiplication is evaluated in 32-bit arithmetic and can wrap before being widened to the 64-bit size_t accumulator. The preceding overflow guard divides in 64-bit arithmetic and so does not constrain the 32-bit product, and the subsequent comparison against PICTURE_SW_SIZE_MAX evaluates the already-wrapped value, so both checks pass. The vulnerable chain starts in modules/codec/png.c, which extracts width/height from the PNG's IHDR chunk via png_get_IHDR() with no range validation, writes them straight into p_dec->fmt_out.video.i_visible_width/i_visible_height, and calls decoder_NewPicture() -> AllocatePicture() with those attacker-controlled dimensions. The only upstream guard, in the image demuxer's Load() (modules/demux/image.c), is a flat 128 MiB total-file-size ceiling (const unsigned max_size = 4096 * 4096 * 8, i.e. 134,217,728 bytes) checked against the file's byte size on disk -- it performs no check on the IHDR-declared width/height themselves, so a small file can still declare enormous dimensions. An attacker crafts a PNG with an IHDR chunk declaring extremely large width/height values (e.g. near 65535x65535); the malformed file passes the file-size gate, the wraparound in AllocatePicture produces an undersized heap allocation, and the PNG decoder then writes scanlines sized to the (unwrapped) original dimensions past the end of that buffer, corrupting the heap with attacker-influenced data. VulnCheck's advisory and NVD both describe this as enabling potential arbitrary code execution once weaponized; no public PoC/exploit tool has been located.

CVE-2026-73324 (heap out-of-bounds read, CWE-125/CWE-170, NVD CVSS 3.1 base 6.5: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N; CVSS 4.0 base 6.9: AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) lives in the RealRTSP access module: RtspReadLine in modules/access/rtsp/access.c uses strncpy() with the full 4096-byte BUF_SIZE destination length to copy a server response line, and strncpy does not append a NUL terminator when the source line is at least as long as the destination. The resulting unterminated buffer is passed to strdup() in modules/access/rtsp/rtsp.c (rtsp_get), which keeps reading past the buffer's end until it happens to find a zero byte elsewhere in the heap, disclosing adjacent memory contents. The vulnerable input is the RTSP Session header returned by the server; VLC stores the over-read data as its session identifier and echoes it back to the same server in every subsequent request on that session, effectively exfiltrating the leaked heap bytes to the attacker over the RTSP connection it already controls. VulnCheck states a single malicious playlist entry containing a RealRTSP URL is sufficient to trigger the bug; the attacker controls the returned line's length and therefore the extent of the disclosure. RealRTSP is optional at build time but is compiled into official VideoLAN builds.

Both bugs share the same git-history affected range per OSV.dev: introduced at commit 8d432b090e08f141ce9156dc728afbed4636301b, last-affected at 578d28f6c9f2379164516e689418f92ac74a3445, with no fixing commit published. Both were found by Fabian Wahle of Hap Security, assigned CVE IDs by VulnCheck (acting as CNA), and disclosed via two separate VulnCheck technical advisories on 2026-09-09 (NVD published both records at 2026-09-09T14:17 UTC and added the CVSS 4.0 vectors in a same-day update at 2026-09-09T20:20 UTC, with NVD analysis status recorded as 'Deferred'). The Debian Security Tracker lists VLC as vulnerable and explicitly '(unfixed)' for both CVEs across bookworm (3.0.23-0+deb12u1), trixie (3.0.23-0+deb13u1), and unstable/sid (3.0.23-3) as of 2026-09-12. As of that date no patched upstream release exists -- VLC's latest 3.0-branch build remains 3.0.23 -- no public working exploit/PoC tool has been located, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog (checked against the 2026-09-11 edition, 1,709 total entries), so there is no evidence of in-the-wild exploitation.

MITRE ATT&CK techniques used in TL-2026-2464

Command and Control

T1071 Application Layer Protocol

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Resource Development

T1583.004 Acquire Infrastructure: Server; T1587.004 Develop Capabilities: Exploits; T1588.006 Vulnerabilities; T1608.001 Stage Capabilities: Upload Malware

Affected products and versions in VLC Media Player

  • VideoLAN — VLC media player
    Vulnerable versions: 3.0.0; 3.0.1; ...; 3.0.23
  • Debian — vlc (bookworm/trixie/sid packages)
    Vulnerable versions: 3.0.23-0+deb12u1 (bookworm); 3.0.23-0+deb13u1 (trixie); 3.0.23-3 (sid/unstable)

Remediation for VLC Media Player

Patches

  • No official patch is available as of 2026-09-12; VLC's newest 3.0-branch release remains 3.0.23; Debian Security Tracker lists bookworm, trixie, and sid as vulnerable/unfixed

Immediate actions

  • Avoid opening PNG images, media files, or playlist entries (.m3u/.xspf/.pls) from untrusted or unsolicited sources in VLC
  • Avoid connecting VLC to untrusted, unauthenticated, or unexpected RTSP servers/streams, including realrtsp:// playlist entries
  • Where feasible, disable or restrict the RealRTSP access module in enterprise VLC deployments until a fix ships

Workarounds

  • Do not open PNG files, media files, or playlists received from untrusted or unverified sources
  • Do not point VLC at RTSP/realrtsp URLs controlled by untrusted third parties

Longer-term hardening

  • Monitor VideoLAN's GitHub repository and release notes for a 3.0.24 (or later) security release patching AllocatePicture (src/misc/picture.c), the PNG decoder's IHDR handling (modules/codec/png.c), and RtspReadLine (modules/access/rtsp/access.c)
  • Deploy EDR/behavioral monitoring for anomalous crashes or heap-corruption fault signatures in the VLC process (vlc.exe / vlc) following media file or RTSP stream access
  • Include untrusted-media-file and untrusted-streaming-URL risks in user security-awareness training, since both bugs require a user-driven action to trigger
  • Track distro package advisories (Debian bookworm/trixie/sid, Ubuntu) for backported fixes, since both CVEs are currently marked unfixed across all tracked Debian suites

CVEs associated with VLC Media Player

CVE-2026-56711, CVE-2026-73324

Weaknesses (CWE) in VLC Media Player

CWE-190, CWE-787, CWE-125, CWE-170

Timeline of VLC Media Player

  • Cyber Security News publishes 'Multiple VLC Media Player Vulnerabilities,' the source feed article that seeded this hunt.
  • NVD records are last-modified at 20:20 UTC the same day, adding CVSS 4.0 vectors (8.6 for CVE-2026-56711, 6.9 for CVE-2026-73324) alongside the original CVSS 3.1 scores.
  • Both CVEs are published to the NVD at 14:17 UTC with CVSS 3.1 base scores of 8.8 (CVE-2026-56711) and 6.5 (CVE-2026-73324); NVD analysis status is recorded as 'Deferred'.
  • VulnCheck, acting as CNA, assigns CVE-2026-56711 and CVE-2026-73324 and publishes two separate technical advisories detailing the root-cause code paths for both bugs.
  • Fabian Wahle of Hap Security discloses CVE-2026-56711 (AllocatePicture integer overflow) and CVE-2026-73324 (RtspReadLine out-of-bounds read) in VLC 3.0.0-3.0.23.
  • SecurityOnline.info reports both flaws, explicitly noting 'no official patch exists at the time of writing.'
  • Neither CVE-2026-56711 nor CVE-2026-73324 appears in the CISA Known Exploited Vulnerabilities catalog (2026-09-11 edition, 1,709 total entries), indicating no confirmed in-the-wild exploitation as of that date.
  • The OSV.dev records for both CVEs are aggregated with git affected-range data (introduced at commit 8d432b09, last-affected at commit 578d28f6, no fix commit); GBHackers publishes further technical analysis of both CVEs.
  • As of this date VLC's latest 3.0-branch release remains 3.0.23; no VLC 3.0.24 or other patched build addressing either CVE has been published, and no public working exploit/PoC has been located.
  • The Debian Security Tracker lists both CVEs as vulnerable and explicitly '(unfixed)' across bookworm (3.0.23-0+deb12u1), trixie (3.0.23-0+deb13u1), and unstable/sid (3.0.23-3).

Sources cited for VLC Media Player

More in vulnerability

Detection coverage for TL-2026-2464

As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2464 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats