In short: Two unpatched vulnerabilities have been found in VLC Media Player versions 3.0.0 through 3.0.23. CVE-2026-56711 (CVSS 8.6) lets a specially crafted PNG file corrupt heap memory — opening a malicious file or playlist is all an attacker needs. CVE-2026-73324 (CVSS 6.9) leaks memory contents via a malicious RTSP stream. No patched version is available as of this writing.
What happened
Between September 9 and 11, 2026, researcher Fabian Wahle of Hap Security publicly disclosed two vulnerabilities in VLC Media Player, covered by Anti-Malware.ru, Cybersecurity News, and the Open Source Vulnerabilities (OSV) registry. VLC is among the world's most widely used media players — free, cross-platform (Windows, macOS, Linux, Android, iOS), and installed on hundreds of millions of devices globally.
VideoLAN has been notified and is working on a fix, but the current release remains 3.0.23, in which both vulnerabilities are present. The interim mitigation recommended by VideoLAN: avoid opening media files and playlists from untrusted sources, and decline unfamiliar RealRTSP links.
CVE-2026-56711: PNG file overflows heap memory
The more severe flaw (CVSS 8.6) lives in the AllocatePicture function within src/misc/picture.c. When VLC parses a PNG image, it reads width and height from the IHDR header and feeds them into a 32-bit buffer-size calculation. An attacker can craft a PNG with abnormally large width and height values, triggering a 32-bit integer overflow — the allocated buffer is too small for the actual image data.
VLC then writes image scanlines beyond the end of the allocated buffer — a heap buffer overflow. A well-crafted overflow of this type can steer execution into attacker-controlled code running with the privileges of the current user account. The attack requires the victim to open a malicious file or playlist entry; no elevated privileges are needed on the attacker's side.
Our LiMP VPN blog has covered the broader trend of ordinary file formats — archives, office documents, and now media files — becoming reliable delivery vehicles for malware in 2026.
CVE-2026-73324: memory disclosure via streaming links
The second flaw (CVSS 6.9) is in the RealRTSP module, which handles RTSP stream playback. A missing null terminator when processing a server response longer than 4096 bytes causes VLC to read past the buffer boundary (out-of-bounds read), relaying adjacent memory contents toward the attacker.
Exploitation requires the victim to connect to an attacker-controlled server — for example, by following a malicious rtsp:// link in an email or messaging app. The leaked memory may contain sensitive session data. This type of memory-disclosure bug often serves as a stepping stone for deeper exploitation.
Why a media player is a serious attack surface
VLC is trusted by default — people open video files without questioning the source. That trust is exactly what makes it attractive to attackers. The delivery vector is low-friction: a malicious file in a Telegram chat, email attachment, torrent download, or a phishing page posing as a movie site.
If CVE-2026-56711 is exploited successfully, attacker code runs with the victim's account privileges. The standard consequences apply: browser-stored passwords extracted, banking and email sessions hijacked, ransomware or spyware silently installed. Breach data already circulating from other services — see our LiMP VPN news section for recent incidents — gives attackers targeting precision to make attempts convincing.
What to do right now
Watch for a VLC update and install it immediately. No patch exists yet — the current release is still 3.0.23. As soon as VideoLAN ships 3.0.24 or higher, update without delay. VLC does not auto-update on all platforms; check manually via Help → Check for Updates (Windows/macOS) or your mobile app store.
Do not open media files from untrusted sources. Until the patch ships, avoid opening video, audio, or playlist files received in email, messaging apps, or downloaded from unfamiliar sites. Our guide on protecting accounts from hijacking covers safe file-handling habits in detail.
Reject RTSP links from unknown senders. Any link containing rtsp://, or an invitation to stream from an unfamiliar address, is a potential CVE-2026-73324 vector. This also applies to QR codes that may encode RTSP URLs.
Add a network-layer defence. A VPN does not fix a bug in VLC's code — only the patch does. But an encrypted tunnel prevents session interception at the network level: your ISP, the router owner, or anyone else on the same Wi-Fi network cannot see your data in plain text. LiMP VPN for iOS and Android operates under a strict no-logs policy. Plans start at $0.99/month — see the pricing page.