# VLC Media Player: Integer Overflow in AllocatePicture (CVE-2026-56711) and RTSP Heap Out-of-Bounds Read (CVE-2026-73324)

> Two memory-safety flaws disclosed 2026-09-09 in VLC Media Player 3.0.0 through 3.0.23: a 32-bit integer-overflow/heap out-of-bounds write in the picture-buffer allocator (AllocatePicture) triggerable via a crafted PNG's oversized IHDR dimensions, and a heap out-of-bounds read in the RealRTSP access module (RtspReadLine/strdup) triggerable by a malicious RTSP server sending an unterminated response line. Both require user interaction (opening a crafted file/playlist or connecting to an attacker-controlled RTSP stream); no patch is available as of 2026-09-12.

- **Published:** 2026-09-12T00:00:00Z
- **Last reviewed:** 2026-09-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2464
- **ID:** TL-2026-2464
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56711, CVE-2026-73324

## Description

CVE-2026-56711 (heap out-of-bounds write, CWE-190/CWE-787, NVD CVSS 3.1 base 8.8: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; CVSS 4.0 base 8.6: AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) lives in AllocatePicture in src/misc/picture.c. VLC computes the buffer size needed for a decoded image plane by accumulating i_bytes += p->i_pitch * p->i_lines, both plane_t fields declared as signed int in include/vlc_picture.h, so the multiplication is evaluated in 32-bit arithmetic and can wrap before being widened to the 64-bit size_t accumulator. The preceding overflow guard divides in 64-bit arithmetic and so does not constrain the 32-bit product, and the subsequent comparison against PICTURE_SW_SIZE_MAX evaluates the already-wrapped value, so both checks pass. The vulnerable chain starts in modules/codec/png.c, which extracts width/height from the PNG's IHDR chunk via png_get_IHDR() with no range validation, writes them straight into p_dec->fmt_out.video.i_visible_width/i_visible_height, and calls decoder_NewPicture() -> AllocatePicture() with those attacker-controlled dimensions. The only upstream guard, in the image demuxer's Load() (modules/demux/image.c), is a flat 128 MiB total-file-size ceiling (const unsigned max_size = 4096 * 4096 * 8, i.e. 134,217,728 bytes) checked against the file's byte size on disk -- it performs no check on the IHDR-declared width/height themselves, so a small file can still declare enormous dimensions. An attacker crafts a PNG with an IHDR chunk declaring extremely large width/height values (e.g. near 65535x65535); the malformed file passes the file-size gate, the wraparound in AllocatePicture produces an undersized heap allocation, and the PNG decoder then writes scanlines sized to the (unwrapped) original dimensions past the end of that buffer, corrupting the heap with attacker-influenced data. VulnCheck's advisory and NVD both describe this as enabling potential arbitrary code execution once weaponized; no public PoC/exploit tool has been located.

CVE-2026-73324 (heap out-of-bounds read, CWE-125/CWE-170, NVD CVSS 3.1 base 6.5: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N; CVSS 4.0 base 6.9: AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) lives in the RealRTSP access module: RtspReadLine in modules/access/rtsp/access.c uses strncpy() with the full 4096-byte BUF_SIZE destination length to copy a server response line, and strncpy does not append a NUL terminator when the source line is at least as long as the destination. The resulting unterminated buffer is passed to strdup() in modules/access/rtsp/rtsp.c (rtsp_get), which keeps reading past the buffer's end until it happens to find a zero byte elsewhere in the heap, disclosing adjacent memory contents. The vulnerable input is the RTSP Session header returned by the server; VLC stores the over-read data as its session identifier and echoes it back to the same server in every subsequent request on that session, effectively exfiltrating the leaked heap bytes to the attacker over the RTSP connection it already controls. VulnCheck states a single malicious playlist entry containing a RealRTSP URL is sufficient to trigger the bug; the attacker controls the returned line's length and therefore the extent of the disclosure. RealRTSP is optional at build time but is compiled into official VideoLAN builds.

Both bugs share the same git-history affected range per OSV.dev: introduced at commit 8d432b090e08f141ce9156dc728afbed4636301b, last-affected at 578d28f6c9f2379164516e689418f92ac74a3445, with no fixing commit published. Both were found by Fabian Wahle of Hap Security, assigned CVE IDs by VulnCheck (acting as CNA), and disclosed via two separate VulnCheck technical advisories on 2026-09-09 (NVD published both records at 2026-09-09T14:17 UTC and added the CVSS 4.0 vectors in a same-day update at 2026-09-09T20:20 UTC, with NVD analysis status recorded as 'Deferred'). The Debian Security Tracker lists VLC as vulnerable and explicitly '(unfixed)' for both CVEs across bookworm (3.0.23-0+deb12u1), trixie (3.0.23-0+deb13u1), and unstable/sid (3.0.23-3) as of 2026-09-12. As of that date no patched upstream release exists -- VLC's latest 3.0-branch build remains 3.0.23 -- no public working exploit/PoC tool has been located, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog (checked against the 2026-09-11 edition, 1,709 total entries), so there is no evidence of in-the-wild exploitation.

## MITRE ATT&CK

- T1588.006 Vulnerabilities
- T1587.004 Develop Capabilities: Exploits
- T1583.004 Acquire Infrastructure: Server
- T1608.001 Stage Capabilities: Upload Malware
- T1203 Exploitation for Client Execution
- T1204.002 User Execution: Malicious File
- T1204.001 User Execution: Malicious Link
- T1071 Application Layer Protocol
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory](https://cybersecuritynews.com/multiple-vlc-media-player-vulnerabilities/)
- [VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation](https://www.vulncheck.com/advisories/vlc-media-player-3.0.0-through-3.0.23-heap-out-of-bounds-write-via-integer-overflow-in-picture-allocation)
- [VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Read via Unterminated RealRTSP Response Line](https://www.vulncheck.com/advisories/vlc-media-player-3.0.0-through-3.0.23-heap-out-of-bounds-read-via-unterminated-realrtsp-response-line)
- [NVD - CVE-2026-56711](https://nvd.nist.gov/vuln/detail/CVE-2026-56711)
- [NVD - CVE-2026-73324](https://nvd.nist.gov/vuln/detail/CVE-2026-73324)
- [CVE.org - CVE-2026-56711 official record](https://cve.org/CVERecord?id=CVE-2026-56711)
- [CVE.org - CVE-2026-73324 official record](https://cve.org/CVERecord?id=CVE-2026-73324)
- [OSV - CVE-2026-56711](https://osv.dev/vulnerability/CVE-2026-56711)
- [OSV - CVE-2026-73324](https://osv.dev/vulnerability/CVE-2026-73324)
- [Debian Security Tracker - CVE-2026-56711](https://security-tracker.debian.org/tracker/CVE-2026-56711)
- [Debian Security Tracker - CVE-2026-73324](https://security-tracker.debian.org/tracker/CVE-2026-73324)
- [VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data](https://gbhackers.com/vlc-media-player-flaws/)
- [Two VLC Media Player Flaws Expose Heap Memory, No Fix Yet](https://securityonline.info/vlc-media-player-vulnerabilities/)
- [VideoLAN VLC source - src/misc/picture.c (3.0.23)](https://github.com/videolan/vlc/blob/3.0.23/src/misc/picture.c)
- [VideoLAN VLC source - include/vlc_picture.h (3.0.23)](https://github.com/videolan/vlc/blob/3.0.23/include/vlc_picture.h)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2464