CVE-2026-73324
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
Risk Assessment
An attacker could trick a user into opening a crafted media stream or file, potentially leaking portions of VLC process memory. This poses a risk to organizations that use VLC to play content from untrusted network sources.
Recommendation
Update VLC to a version later than 3.0.23 or apply the vendor's available fixes. Restrict playback of media from untrusted network sources and inform users about the risk.
Other vulnerabilities in VLC media player
See all- CVE-2026-102875High
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.
- CVE-2019-13962Critical
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
- CVE-2026-56711High
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.
- CVE-2020-26664High
A vulnerability in the EbmlTypeDispatcher::send function of VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
- CVE-2019-19721High
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. This may be related to the SDL_Image product.
- CVE-2019-5459High
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
- CVE-2019-13602High
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
Original NVD description (English source)
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS