VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data
Brief
Two security vulnerabilities in VLC Media Player could enable attackers to corrupt memory or extract sensitive data from affected systems by persuading users to open a specially crafted image file or media playlist.
The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC versions 3.
- 0 through 3.
- 23 and were disclosed on September 9, 2026.
The more severe issue, CVE-2026-56711 , is a high-severity heap out-of-bounds write vulnerability with a CVSS v4 score of 8.6.
VLC Media Player Flaws
Security researcher Fabian Wahle of Hap Security identified the flaw in VLC’s picture-buffer allocation logic, where the application calculates the memory required to process image data.
VLC uses 32-bit integer arithmetic while accumulating picture-plane sizes in the AllocatePicture function within src/misc/picture. c .