Search
Find merged stories by title or summary.
Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory
Two security vulnerabilities in VLC Media Player could allow attackers to corrupt heap memory or disclose sensitive data from a victim’s memory. The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC Media Player versions 3. 0. 0 through 3. 0. 23 and require a victim to open a specially crafted media file or playlist entry. Fabian Wahle of Hap Security discovered the vulnerabilities. CVE-2026-56711 carries a high severity rating with a CVSS score of 8. 6, while CVE-2026-73324 is rated medium severity with a CVSS score of 6. 9. Both issues were disclosed on September 9, 2026. CVE-2026-56711 is an integer overflow and out-of-bounds write vulnerability in VLC’s picture-buffer allocation logic. The flaw is associated with CWE-190, Integer Overflow or Wraparound, and CWE-787, Out-of-bounds Write.
VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data
Two security vulnerabilities in VLC Media Player could enable attackers to corrupt memory or extract sensitive data from affected systems by persuading users to open a specially crafted image file or media playlist. The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC versions 3. 0. 0 through 3. 0. 23 and were disclosed on September 9, 2026. The more severe issue, CVE-2026-56711 , is a high-severity heap out-of-bounds write vulnerability with a CVSS v4 score of 8.6. VLC Media Player Flaws Security researcher Fabian Wahle of Hap Security identified the flaw in VLC’s picture-buffer allocation logic, where the application calculates the memory required to process image data. VLC uses 32-bit integer arithmetic while accumulating picture-plane sizes in the AllocatePicture function within src/misc/picture. c .
NVD-CVE-2026-73324 - nvd.nist.gov
NVD-CVE-2026-73324 nvd. nist. gov
You've reached the end of current stories for this search.