Reported by 3 outlets

Timeline

1. original reporting

   Two VLC media player vulnerabilities (CVE-2026-56711, CVE-2026-73324) allow heap out-of-bounds write and read. No patch is available yet. #

   securityonline.info · 32d ago · September 11th, 2026

   Two VLC media player vulnerabilities (CVE-2026-56711, CVE-2026-73324) allow heap out-of-bounds write and read. No patch is available yet. #

   via Mastodon https://securityonline.info/vlc-media-player-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

2. update from cyberpress.org

   VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

   cyberpress.org · 32d ago · September 11th, 2026

   Two security vulnerabilities in VLC Media Player could enable attackers to corrupt memory or extract sensitive data from affected systems by persuading users to open a specially crafted image file or media playlist. The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC versions 3.0.0 through 3.0.23 and were disclosed on September 9, 2026. The more severe issue, CVE-2026-56711 , is a high-severity heap out-of-bounds write vulnerability with a CVSS v4 score of 8.6. VLC Media Player Flaws Security researcher Fabian Wahle of Hap Security identified the flaw in VLC’s picture-buffer allocation logic, where the application calculates the memory required to process image data. VLC uses 32-bit integer arithmetic while accumulating picture-plane sizes in the AllocatePicture function within src/misc/picture.c . The calculation adds the product of each plane’s pitch and number of lines to a running total. Because the relevant values are stored as signed int fields, the multiplication can overflow and wrap to a much smaller value before the result is expanded into the larger size_t allocation variable. As a result, VLC can reserve a small heap buffer even though the decoder later handles image dimensions that require substantially more memory. Existing checks do not reliably stop the condition because one validates values in 64-bit arithmetic while the vulnerable multiplication occurs at 32 bits. A later size comparison also evaluates the already wrapped value rather than th

3. update from beyondmachines.net

   VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure VideoLAN reports two vulnerabilities in VLC Media Player (CVE-202

   beyondmachines.net · 30d ago · September 13th, 2026

   VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure VideoLAN reports two vulnerabilities in VLC Media Player (CVE-202

   via Mastodon https://beyondmachines.net/event_details/vlc-media-player-flaws-allow-heap-corruption-and-sensitive-data-disclosure-6-k-q-2-9/gD2P6Ple2L