CVE-2026-73324: Out-of-bounds Read in VideoLAN VLC media player
Affects VideoLAN VLC media playerSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| VideoLANVLC media player | Affected
| Fixed in– |
GitHub ActionsVLC media playerpkg:github/VLC media playerOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a patch is available, users should exercise caution when opening media from untrusted network sources and avoid interacting with suspicious content.
Description
Certain VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability that can lead to an out-of-bounds read when processing media from attacker-controlled network sources. Exploitation requires user interaction and may disclose a limited amount of VLC process memory depending on the build configuration. The vulnerability has a medium severity rating with a CVSS score of 5.3.
Impact
An attacker who can supply media from a network source and convince a user to interact with it may cause VLC to read memory out-of-bounds, potentially disclosing a limited amount of process memory. This could lead to partial information disclosure but does not indicate code execution or system compromise. The impact is limited by the requirement for user interaction and the constrained nature of the memory disclosure.
Summary
CVE-2026-73324 is a memory-safety vulnerability in VLC media player versions 3.0.0 through 3.0.23. It involves an out-of-bounds read triggered by processing media from an attacker-controlled network source. Successful exploitation requires user interaction and may result in disclosure of a limited, layout-dependent portion of the VLC process memory. The extent of exposure depends on the specific build configuration of VLC. There is no indication of known exploits in the wild or vendor-provided patches at this time.
References
- github.com/videolan/vlc (opens in a new tab)
- github.com/videolan/vlc/blob/3.0.23/modules/access/rtsp/access.c (opens in a new tab)
- github.com/videolan/vlc/blob/3.0.23/modules/access/rtsp/rtsp.c (opens in a new tab)
- vulncheck.com/advisories/vlc-media-player-3.0.0-through-3.0.23-heap-out-of-bounds-read-via-unterminated-realrtsp-response-line (opens in a new tab)