Threat Intelligence Database

CVE-2026-73324 is an out-of-bounds read vulnerability in VLC media player's RTSP module. The flaw occurs because VLC copies an RTSP response line into a fixed-size buffer without ensuring null termination, leading to reading beyond the buffer when the response line is 4096 bytes or longer. This causes heap memory disclosure to a hostile RTSP server, as the leaked data is sent back in subsequent requests as the session identifier. The vulnerability affects VLC versions 3.0.0 through 3.0.23. The RTSP module is a build-time option and may be disabled in some distributions. The CVSS 4.0 score is 6.9 (medium severity). No official patch or remediation guidance is currently available.

CVE-2026-56711 is a high-severity integer overflow vulnerability in VLC media player that occurs when computing the size of a picture buffer using 32-bit arithmetic, leading to a wrapped allocation size. A crafted PNG file with large declared dimensions can trigger a buffer overflow when decoded, potentially allowing out-of-bounds memory writes. This vulnerability affects VLC versions 3.0.0 through 3.0.23 inclusive and requires only that the malicious file be opened, with no special settings needed.