CVE-2026-56711Disclosure

Two security flaws have been found in VLC Media Player, and they could put users at risk if they open malicious files or streams. They are tracked as “CVE-2026-56711” and “CVE-2026-73324” and affect VLC 3.0.0 through 3.0.23. > The first one is the more serious issue. A specially made PNG image, a malicious image could cause a memory error that may lead to a crash or, in some cases, potentially allow an attacker to run code. > The second vulnerability affects RTSP streaming, a malicious server could potentially make VLC read data from memory that it shouldn’t be able to access. The good news is that an attacker generally needs to trick the user into opening a malicious file, playlist or stream. Just use your brain and avoid opening media from unknown sources and update VLC as soon as a security fix is available.

🚨 Two VLC Media Player flaws can allow code execution and leak sensitive memory Security researchers have disclosed two vulnerabilities affecting VLC Media Player versions 3.0.0 through 3.0.23. ⠀ CVE-2026-56711, rated 8.6, is a heap out-of-bounds write caused by an integer overflow in VLC's picture buffer allocation. An attacker can craft a malicious PNG with manipulated dimensions that causes VLC to allocate an undersized memory buffer before writing beyond its boundaries. The flaw can potentially lead to arbitrary code execution when the malicious image is opened directly or loaded through a playlist. ⠀ CVE-2026-73324, rated 6.9, affects VLC's RealRTSP handling. A malicious RTSP server can send an oversized response that causes VLC to read beyond an allocated buffer and return adjacent heap memory to the attacker, potentially exposing sensitive information. ⠀ The vulnerable RealRTSP component is enabled in official VideoLAN builds, although some Linux distribution packages may compile VLC without it. ⠀ As of September 11, VLC 3.0.23 remains the current stable desktop release listed by VideoLAN and is affected by both vulnerabilities. Users should avoid opening untrusted image files or RealRTSP playlist links until an updated release addressing the flaws becomes available.

Vulnerabilidades en VLC permiten corromper o leer la memoria heap Se han detectado dos vulnerabilidades de seguridad ( CVE-2026-56711 y CVE-2026-73324 ) en VLC Media Player https://blog.elhacker.net/2026/09/vulnerabilidades-en-vlc-permiten.html

🚨 VLC Media Player'da 2 güvenlik açığı! VLC Media Player'ın 3.0.0–3.0.23 sürümlerini etkileyen iki güvenlik açığı tespit edildi: 🔴 CVE-2026-56711 — CVSS 8.6 Özel hazırlanmış PNG dosyasıyla tetiklenebilen integer overflow / heap out-of-bounds write açığı. Bellek bozulmasına ve potansiyel olarak kod çalıştırmaya yol açabiliyor. 🟠 CVE-2026-73324 — CVSS 6.9 Kötü amaçlı RTSP sunucusunun VLC istemcisinin heap belleğinden veri okuyabilmesine yol açan out-of-bounds read açığı. Açıklar hem Windows hem Linux üzerinde kullanılan VLC sürümlerini etkiliyor. Kullanıcıların VLC'yi güncel sürüme yükseltmeleri ve güvenilmeyen medya dosyalarını/playlist'leri açmamaları öneriliyor.

مجرد فتح ملف صورة قد يتيح لمهاجم تنفيذ أكواد برمجية على جهازك! ثغرتان (CVE-2026-56711 وCVE-2026-73324) في مشغل VLC، ترتبط الأولى بمعالجة ملفات صور خبيثة بصيغة PNG، حيث تؤدي إلى انهيار الذاكرة والسيطرة على الجهاز. بينما تجبر الثانية المشغل على قراءة معلومات حساسة من الذاكرة. https://t.co/6GkKB6vfRD

🚨 VLC Media Player has been hit by TWO serious security vulnerabilities. CVE-2026-56711 can turn a malicious PNG into a heap out-of-bounds write through an integer overflow, potentially leading to code execution. And CVE-2026-73324 can expose heap memory to a malicious RTSP server. The scary part? You don't need some specific configuration. A poisoned image, playlist, or malicious streaming URL can be enough to put a vulnerable VLC installation in the attacker's crosshairs. VLC 3.0.0 through 3.0.23 are affected. If you use VLC, don't blindly open media files or playlists from untrusted sources, and update as soon as a patched build becomes available. I've broken down exactly how both vulnerabilities work, their attack paths, affected versions, and what users and organizations should do right now: https://thecybersecguru.com/news/vlc-media-player-vulnerabilities-cve-2026-56711-cve-2026-73324/

🚨 Security Alert for VLC Media Player Two vulnerabilities (CVE-2026-56711 & CVE-2026-73324) affect VLC versions 3.0.0 to 3.0.23: • A bad PNG image can crash the app or let hackers run code. • A malicious RTSP stream can leak private data. ⚠️ update VLC ASAP! https://t.co/CbYsQWnG26

VLC Media Player の脆弱性 CVE-2026-56711／73324：メモリ破壊とデータ流出の恐れ https://iototsecnews.jp/2026/09/11/vlc-media-player-flaws-let-attackers-corrupt-memory-and-leak-sensitive-data/ VLC Media Player 3.0.0～3.0.23 にメモリ領域の破壊や情報漏洩を引き起こす脆弱性 CVE-2026-56711／CVE-2026-73324 が存在します。画像バッファ割り当て時の計算不備や RTSP レスポンス処理の欠陥が背景にあり、悪意のある PNG ファイルの処理／攻撃者が制御する RealRTSP サーバへの接続により発生します。影響として、領域外へのデータ書き込みによるアプリのクラッシュ／メモリ内の機密データ流出が挙げられます。対応策は、信頼できない画像やプレイリストの閲覧回避／修正版への更新が推奨されます。 #CVE202656711 #CVE202673324 #VLC #Vulnerability

Two VLC media player vulnerabilities (CVE-2026-56711, CVE-2026-73324) allow heap out-of-bounds write and read. No patch is available yet. #VLC #VideoLAN #VLCvulnerability #CVE #HeapOverflow #MediaPlayer #InfoSec #IntegerOverflow #RTSP #PatchNow https://securityonline.info/vlc-media-player-vulnerabilities/ https://t.co/S1LWamAT2H

عندكم خبر عن ثغرات VLC؟ 🛡️ ثغرتين أمنيتين في VLC Media Player تقدر تخرب الـ heap memory أو تسرّب بيانات حساسة من ذاكرة الضحية. الثغرتين مسجلين باسم CVE-2026-56711 و CVE-2026-73324، وتأثر على نسخ VLC من 3.0.0 لين 3.0.23، وتبغى الضحية يفتح ملف وسائط أو playlist entry معدّل بطريقة خاصة. المهاجم يقدر يستغلها بصورة PNG مصنوعة بقيم width و height مبالغ فيها في IHDR header، لأن الـ image demuxer في VLC يتأكد من حجم الملف بس ما يتحقق زين من أبعاد الصورة المعلنة.

Two VLC Media Player vulnerabilities — CVE-2026-56711 and CVE-2026-73324 — are putting users at risk of heap corruption and sensitive data exposure. The first flaw comes from integer overflow in the picture buffer handling (PNG images), the second exposes memory via RTSP response parsing with missing null termination. Affects VLC versions 3.0.0-3.0.23. Until patched, avoid untrusted PNGs, playlists, RTSP streams, and monitor VLC usage in high-risk environments. #VLC #Cybersecurity #Vulnerabilities #HeapCorruption #RTSP #MediaPlayer https://thedailytechfeed.com/critical-vlc-flaws-let-attackers-read-or-corrupt-heap-memory/

VLCメディアプレイヤーに CVE-2026-56711(8.6)、CVE-2026-73324(6.9)の 脆弱性告知でてるのか。 そしてこれらへの対応はまだアップデート出てないと https://nvd.nist.gov/vuln/detail/cve-2026-56711 https://nvd.nist.gov/vuln/detail/cve-2026-73324