VLC Media Player: Integer Overflow in AllocatePicture (CVE-2026-56711) and RTSP Heap Out-of-Bounds Read (CVE-2026-73324)

Key facts for VLC Media Player heap overflow

Detection coverage for VLC Media Player heap overflow

As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2464 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: VLC Spawns LOLBin Child Process After Crash — Possible Weaponized Heap Overflow (CVE-2026-56711)

Detects vlc.exe spawning a living-off-the-land binary (cmd.exe, powershell.exe, rundll32.exe, mshta.exe, regsvr32.exe, wscript.exe, cscript.exe) as a direct child process. VLC has no legitimate reason to spawn any of these; observing it indicates the AllocatePicture heap out-of-bounds write has been weaponized past a crash/DoS into arbitrary code execution.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1499.004
• Data sources: sysmon_process_creation, microsoft_defender_deviceprocessevents
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\vlc.exe"
| regex Image="(?i)\\\\(cmd\.exe|powershell\.exe|pwsh\.exe|rundll32\.exe|mshta\.exe|regsvr32\.exe|wscript\.exe|cscript\.exe)$"
| table _time, host, user, ParentImage, ParentProcessId, Image, ProcessId, CommandLine
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "vlc.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","mshta.exe","regsvr32.exe","wscript.exe","cscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId, ProcessId

Sigma

title: Suspicious LOLBin Child Process of vlc.exe
id: 9c2f5b6d-1a8e-4d3c-b7f2-5e0a9d4c7b22
status: experimental
description: Detects a living-off-the-land binary spawned directly by vlc.exe, which has no legitimate reason to launch a shell, script host, or DLL-execution utility. Indicates successful code execution following the AllocatePicture heap overflow (CVE-2026-56711).
references:
    - https://www.vulncheck.com/advisories/vlc-media-player-3.0.0-through-3.0.23-heap-out-of-bounds-write-via-integer-overflow-in-picture-allocation
    - https://github.com/videolan/vlc/blob/3.0.23/src/misc/picture.c
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-12
tags:
    - attack.execution
    - attack.t1203
    - attack.t1499.004
    - cve.2026.56711
    - cwe.190
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\vlc.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\rundll32.exe'
            - '\mshta.exe'
            - '\regsvr32.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Third-party VLC plugins or extensions that legitimately shell out (rare and should be inventoried and allow-listed)
level: critical

Known false positives:

• A locally-installed VLC Lua extension or skin that legitimately shells out to a helper utility (should be rare and inventoried)

Tuning notes: Allow-list any known-good VLC extension helper processes seen in a baseline before enabling this at critical severity; pair with the CVE-2026-2464-{SPL/KQL/SIG}-001 crash-precursor detection to build a full kill-chain alert.

• 🔒 VLC Launch Against Untrusted PNG/Playlist File (Sentinel) · unlock with TL Creds
• 🔒 VLC Process Crash / Access Violation Correlated With Recent PNG Playback (CVE-2026-56711) · unlock with TL Creds
• 🔒 Sustained VLC RTSP Session Reuse to External Server (Heap-Leak Exfiltration Pattern, CVE-2026-73324) · unlock with TL Creds
• 🔒 VLC Process Creation With Oversized-IHDR-Candidate PNG or Playlist Argument · unlock with TL Creds
• 🔒 vlc.exe Spawns Command Interpreter or Script Host (Post-Exploitation Indicator) · unlock with TL Creds
• 🔒 vlc.exe Outbound RTSP Connection to Public IP Address · unlock with TL Creds
• 🔒 VLC Opens Untrusted PNG/Playlist Followed by Access Violation Crash (CVE-2026-56711) · unlock with TL Creds
• 🔒 VLC Outbound RTSP Session to External Server Consistent With Heap Memory Leak (CVE-2026-73324) · unlock with TL Creds

Indicators of compromise for VLC Media Player heap overflow

As of 2026-09-12, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2464.

Sample indicators (2 of 17)

• File hash: 8d432b090e08f141ce9156dc728afbed4636301b
• File hash: 578d28f6c9f2379164516e689418f92ac74a3445

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How VLC Media Player heap overflow works

Both require user interaction (opening a crafted file/playlist or connecting to an attacker-controlled RTSP stream); no patch is available as of 2026-09-12.

CVE-2026-56711 (heap out-of-bounds write, CWE-190/CWE-787, NVD CVSS 3.1 base 8.8: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; CVSS 4.0 base 8.6: AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) lives in AllocatePicture in src/misc/picture.c. VLC computes the buffer size needed for a decoded image plane by accumulating i_bytes += p->i_pitch * p->i_lines, both plane_t fields declared as signed int in include/vlc_picture.h, so the multiplication is evaluated in 32-bit arithmetic and can wrap before being widened to the 64-bit size_t accumulator. The preceding overflow guard divides in 64-bit arithmetic and so does not constrain the 32-bit product, and the subsequent comparison against PICTURE_SW_SIZE_MAX evaluates the already-wrapped value, so both checks pass. The vulnerable chain starts in modules/codec/png.c, which extracts width/height from the PNG's IHDR chunk via png_get_IHDR() with no range validation, writes them straight into p_dec->fmt_out.video.i_visible_width/i_visible_height, and calls decoder_NewPicture() -> AllocatePicture() with those attacker-controlled dimensions. The only upstream guard, in the image demuxer's Load() (modules/demux/image.c), is a flat 128 MiB total-file-size ceiling (const unsigned max_size = 4096 * 4096 * 8, i.e. 134,217,728 bytes) checked against the file's byte size on disk -- it performs no check on the IHDR-declared width/height themselves, so a small file can still declare enormous dimensions. An attacker crafts a PNG with an IHDR chunk declaring extremely large width/height values (e.g. near 65535x65535); the malformed file passes the file-size gate, the wraparound in AllocatePicture produces an undersized heap allocation, and the PNG decoder then writes scanlines sized to the (unwrapped) original dimensions past the end of that buffer, corrupting the heap with attacker-influenced data. VulnCheck's advisory and NVD both describe this as enabling potential arbitrary code execution once weaponized; no public PoC/exploit tool has been located.

CVE-2026-73324 (heap out-of-bounds read, CWE-125/CWE-170, NVD CVSS 3.1 base 6.5: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N; CVSS 4.0 base 6.9: AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) lives in the RealRTSP access module: RtspReadLine in modules/access/rtsp/access.c uses strncpy() with the full 4096-byte BUF_SIZE destination length to copy a server response line, and strncpy does not append a NUL terminator when the source line is at least as long as the destination. The resulting unterminated buffer is passed to strdup() in modules/access/rtsp/rtsp.c (rtsp_get), which keeps reading past the buffer's end until it happens to find a zero byte elsewhere in the heap, disclosing adjacent memory contents. The vulnerable input is the RTSP Session header returned by the server; VLC stores the over-read data as its session identifier and echoes it back to the same server in every subsequent request on that session, effectively exfiltrating the leaked heap bytes to the attacker over the RTSP connection it already controls. VulnCheck states a single malicious playlist entry containing a RealRTSP URL is sufficient to trigger the bug; the attacker controls the returned line's length and therefore the extent of the disclosure. RealRTSP is optional at build time but is compiled into official VideoLAN builds.

Both bugs share the same git-history affected range per OSV.dev: introduced at commit 8d432b090e08f141ce9156dc728afbed4636301b, last-affected at 578d28f6c9f2379164516e689418f92ac74a3445, with no fixing commit published. Both were found by Fabian Wahle of Hap Security, assigned CVE IDs by VulnCheck (acting as CNA), and disclosed via two separate VulnCheck technical advisories on 2026-09-09 (NVD published both records at 2026-09-09T14:17 UTC and added the CVSS 4.0 vectors in a same-day update at 2026-09-09T20:20 UTC, with NVD analysis status recorded as 'Deferred'). The Debian Security Tracker lists VLC as vulnerable and explicitly '(unfixed)' for both CVEs across bookworm (3.0.23-0+deb12u1), trixie (3.0.23-0+deb13u1), and unstable/sid (3.0.23-3) as of 2026-09-12. As of that date no patched upstream release exists -- VLC's latest 3.0-branch build remains 3.0.23 -- no public working exploit/PoC tool has been located, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog (checked against the 2026-09-11 edition, 1,709 total entries), so there is no evidence of in-the-wild exploitation.

MITRE ATT&CK techniques by tactic:

Command and Control

T1071 Application Layer Protocol

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Resource Development

T1583.004 Acquire Infrastructure: Server; T1587.004 Develop Capabilities: Exploits; T1588.006 Vulnerabilities; T1608.001 Stage Capabilities: Upload Malware

Remediation for VLC Media Player heap overflow

Patches

• No official patch is available as of 2026-09-12; VLC's newest 3.0-branch release remains 3.0.23; Debian Security Tracker lists bookworm, trixie, and sid as vulnerable/unfixed

Immediate actions

• Avoid opening PNG images, media files, or playlist entries (.m3u/.xspf/.pls) from untrusted or unsolicited sources in VLC
• Avoid connecting VLC to untrusted, unauthenticated, or unexpected RTSP servers/streams, including realrtsp:// playlist entries
• Where feasible, disable or restrict the RealRTSP access module in enterprise VLC deployments until a fix ships

Workarounds

• Do not open PNG files, media files, or playlists received from untrusted or unverified sources
• Do not point VLC at RTSP/realrtsp URLs controlled by untrusted third parties

Longer-term hardening

• Monitor VideoLAN's GitHub repository and release notes for a 3.0.24 (or later) security release patching AllocatePicture (src/misc/picture.c), the PNG decoder's IHDR handling (modules/codec/png.c), and RtspReadLine (modules/access/rtsp/access.c)
• Deploy EDR/behavioral monitoring for anomalous crashes or heap-corruption fault signatures in the VLC process (vlc.exe / vlc) following media file or RTSP stream access
• Include untrusted-media-file and untrusted-streaming-URL risks in user security-awareness training, since both bugs require a user-driven action to trigger
• Track distro package advisories (Debian bookworm/trixie/sid, Ubuntu) for backported fixes, since both CVEs are currently marked unfixed across all tracked Debian suites

Affected and fixed versions

• VideoLAN — VLC media player
  Vulnerable versions: 3.0.0; 3.0.1; ...; 3.0.23
• Debian — vlc (bookworm/trixie/sid packages)
  Vulnerable versions: 3.0.23-0+deb12u1 (bookworm); 3.0.23-0+deb13u1 (trixie); 3.0.23-3 (sid/unstable)

Timeline of VLC Media Player heap overflow

• 2026-09-09 Cyber Security News publishes 'Multiple VLC Media Player Vulnerabilities,' the source feed article that seeded this hunt.
• 2026-09-09 NVD records are last-modified at 20:20 UTC the same day, adding CVSS 4.0 vectors (8.6 for CVE-2026-56711, 6.9 for CVE-2026-73324) alongside the original CVSS 3.1 scores.
• 2026-09-09 Both CVEs are published to the NVD at 14:17 UTC with CVSS 3.1 base scores of 8.8 (CVE-2026-56711) and 6.5 (CVE-2026-73324); NVD analysis status is recorded as 'Deferred'.
• 2026-09-09 locked-ioc-16, acting as CNA, assigns CVE-2026-56711 and CVE-2026-73324 and publishes two separate technical advisories detailing the root-cause code paths for both bugs.
• 2026-09-09 locked-ioc-14 of locked-ioc-15 discloses CVE-2026-56711 (AllocatePicture integer overflow) and CVE-2026-73324 (RtspReadLine out-of-bounds read) in VLC 3.0.0-3.0.23.
• 2026-09-10 SecurityOnline.info reports both flaws, explicitly noting 'no official patch exists at the time of writing.'
• 2026-09-11 Neither CVE-2026-56711 nor CVE-2026-73324 appears in the CISA Known Exploited Vulnerabilities catalog (2026-09-11 edition, 1,709 total entries), indicating no confirmed in-the-wild exploitation as of that date.
• 2026-09-11 The OSV.dev records for both CVEs are aggregated with git affected-range data (introduced at commit 8d432b09, last-affected at commit 578d28f6, no fix commit); GBHackers publishes further technical analysis of both CVEs.
• 2026-09-12 As of this date VLC's latest 3.0-branch release remains 3.0.23; no VLC 3.0.24 or other patched build addressing either CVE has been published, and no public working exploit/PoC has been located.
• 2026-09-12 The Debian Security Tracker lists both CVEs as vulnerable and explicitly '(unfixed)' across bookworm (3.0.23-0+deb12u1), trixie (3.0.23-0+deb13u1), and unstable/sid (3.0.23-3).

Sources cited for VLC Media Player heap overflow

Showing 15 of 20 sources, primary sources first.

• VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation vulncheck.com · Advisory · 2026-09-09
• VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Read via Unterminated RealRTSP Response Line vulncheck.com · Advisory · 2026-09-09
• NVD - CVE-2026-56711 NVD (NIST) · Advisory · 2026-09-09
• NVD - CVE-2026-73324 NVD (NIST) · Advisory · 2026-09-09
• CVE.org - CVE-2026-56711 official record CVE Program · Advisory · 2026-09-09
• CVE.org - CVE-2026-73324 official record CVE Program · Advisory · 2026-09-09
• OSV - CVE-2026-56711 osv.dev · Advisory · 2026-09-11
• OSV - CVE-2026-73324 osv.dev · Advisory · 2026-09-09
• Debian Security Tracker - CVE-2026-56711 security-tracker.debian.org · Advisory · 2026-09-12
• Debian Security Tracker - CVE-2026-73324 security-tracker.debian.org · Advisory · 2026-09-12
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-09-11
• VideoLAN VLC source - src/misc/picture.c (3.0.23) GitHub · Code repository · 2026-09-09
• VideoLAN VLC source - include/vlc_picture.h (3.0.23) GitHub · Code repository · 2026-09-09
• VideoLAN VLC source - modules/codec/png.c (3.0.23) GitHub · Code repository · 2026-09-09
• VideoLAN VLC source - modules/demux/image.c (3.0.23) GitHub · Code repository · 2026-09-09

More in vulnerability

• Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)
• rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2
• CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store)
• CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal
• SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)