Security Risks Discovered in VLC Media Player: Heap Memory Vulnerabilities Exposed
Recent security assessments have unveiled two critical vulnerabilities within VLC media player, impacting versions 3.0.0 through 3.0.23. These vulnerabilities expose users to potential attacks that exploit heap memory issues, raising significant concerns for millions of VLC users worldwide.
The primary vulnerability, identified as CVE-2026-56711, presents a serious heap out-of-bounds writing flaw and carries a CVSS v4 score of 8.6, signaling a high level of risk. This flaw originates from an integer overflow in VLC’s picture buffer allocation logic, particularly when the media player processes specially crafted PNG images. Attackers can trigger this vulnerability by either processing a malicious PNG file directly or by connecting to RealRTSP servers that they control.
The problematic code resides in a function known as AllocatePicture, located in the source code file src/misc/picture.c. During execution, this routine calculates the required size for image planes by multiplying two parameters, p->i_pitch and p->i_lines, before summing the total for memory allocation. Both of these parameters are defined as 32-bit integer fields, meaning that the arithmetic operates within a 32-bit range before converting the result into a larger size type.
Malicious actors can exploit this vulnerability by manipulating the PNG IHDR (Image Header) metadata, providing exceedingly large values for width and height. This manipulation causes the multiplication process to wrap around, resulting in a smaller-than-expected value for memory allocation. Consequently, this leads to the allocation of an inadequately sized heap buffer. The PNG decoder in VLC then attempts to write scanlines based on the attacker-defined dimensions, permitting writes to exceed the allocated memory space.
Current security checks in place do not adequately address this overflow condition. Although a pre-allocation guard employs 64-bit arithmetic for division, subsequent checks assess already wrapped allocation values, leaving the system vulnerable. In addition, the image demuxer incorrectly verifies the input file’s byte count instead of its declared dimensions.
Consequently, users can inadvertently activate this exploit simply by opening a malicious PNG file or loading it from a playlist, with no complex settings required to invoke the flawed processing pathway.
Fabian Wahle from Hap Security has documented this serious issue, noting its classification as CWE-190 (Integer Overflow or Wraparound) and CWE-787 (Out-of-bounds Write).
In addition to the primary vulnerability, another separate medium-severity flaw has been recognized as CVE-2026-73324, affecting VLC’s handling of RealRTSP streams. This vulnerability earns a CVSS v4 score of 6.9 and involves an out-of-bounds reading caused by improper null termination within RTSP response processing.
The issue lies within the RtspReadLine function, where VLC blindly copies response data into a fixed-size buffer using the strncpy function without guaranteeing the presence of a terminating null byte. If an adversarial RTSP server returns a response line exceeding 4,096 bytes, VLC subsequently passes this unterminated buffer to the strdup function. This operation could read beyond the designated memory boundaries until a stray null byte is located, potentially exposing sensitive client data stored in heap memory.
Attackers can deliver malicious response lines via the RTSP Session header, which VLC preserves as part of the session identifier and transmits to the server in future requests. The implications are serious: user data could be disclosed to malicious servers, presenting a significant privacy risk.
While the RealRTSP module can be disabled at build-time, it may still be active in official VLC builds, making it crucial for users to exercise caution. Until VideoLAN, the organization behind VLC, releases updates to rectify these vulnerabilities, users are advised to treat untrusted image files and RealRTSP playlist entries as potentially hazardous.
In light of these discoveries, it becomes imperative for users to remain vigilant about the files they process using VLC media player. As the security landscape continuously evolves, maintaining up-to-date software is crucial in protecting personal and sensitive data from exploitation. Effective security measures, including regular software updates and cautious file management, will help users safeguard their systems against these emerging threats.