Unpatched VLC Flaws Let Malicious Media Corrupt or Expose Memory

Two VLC media player flaws have been disclosed that could allow attackers to corrupt or read heap memory, with no official patch available at the time of writing. The flaws affect VLC versions 3.0.0 through 3.0.23, and are tracked as CVE-2026-56711 (heap out-of-bounds write via integer overflow in picture allocation) and CVE-2026-73324 (heap out-of-bounds read via unterminated RealRTSP response line).

CVSSv3 scores are 8.8 for the PNG-based write issue and 6.5 for the RTSP read issue, though both are currently listed as not exploited. The VLC RTSP module is enabled by default in VideoLAN builds, though some distributions may disable it.

In terms of impact and mechanics, the PNG flaw arises from 32-bit arithmetic during picture allocation: a crafted PNG can declare enormous width and height, causing the size calculation to wrap and VLC to reserve a tiny buffer, after which full-sized scanlines are written past that buffer simply by opening the file.

The RTSP flaw stems from an unterminated RTSP response line: a hostile server can return a very long line, allowing VLC to read adjacent heap bytes; those leaked bytes can be echoed back on subsequent requests, effectively exposing client memory to the server. Practical response emphasises avoiding untrusted media and avoiding RTSP streams from unknown sources until a patch is released, and monitoring vendor advisories (VulnCheck) for updates.