VLC flaws enable memory corruption and data leakage

Two newly discovered flaws in VLC media player versions 3.0.0 through 3.0.23 can cause memory corruption and data leakage, according to security records published this week. The more severe issue, CVE-2026-56711, is an integer overflow vulnerability in VLC's picture-allocation logic, which can result in a heap out-of-bounds write.

This flaw, with a CVSS v4 score of 8.6 and a CVSS v3.1 score of 8.8, occurs when VLC calculates heap buffer size using 32-bit arithmetic. When a specially crafted PNG image with very large width and height values is opened, VLC allocates an undersized buffer, allowing data to be written beyond the allocated memory region. Successful exploitation of this flaw could lead to arbitrary code execution.

The second vulnerability, CVE-2026-73324, affects VLC's RealRTSP handling and can disclose portions of heap memory to an attacker-controlled RealRTSP server. With a CVSS v4 score of 6.9, this medium-severity flaw is caused by VLC copying RTSP response lines into a fixed-size buffer without ensuring proper termination. When a server returns a Session header of 4,096 bytes or more, a string-handling operation can continue reading beyond the allocated buffer, potentially exposing adjacent heap contents to the attacker.

Both vulnerabilities affect VLC 3.0.0 through 3.0.23, with VideoLAN's public download pages still listing 3.0.23 as the current VLC 3.0 release. Ubuntu's security tracker, updated on September 10, classified the vulnerabilities as medium priority for its VLC packages.