CVE-2026-73324
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length, which writes no terminator when the source line is at least as long as the destination, and rtsp_get in modules/access/rtsp/rtsp.c allocates that buffer as BUF_SIZE bytes and passes it to strdup. When a server returns a line of 4096 bytes or more, strdup measures its length past the end of the allocation and copies adjacent heap bytes until an incidental zero byte. Because the affected line is the Session header, the disclosed bytes are retained as the session identifier and sent back to the server on every subsequent request, so the operator of a hostile server reads heap memory from the client rather than inferring it. The attacker controls the line length and therefore how far the read runs. A single playlist entry naming a realrtsp URL is sufficient. The module is a build-time option, disabled in some distribution packages and enabled in the official VideoLAN builds.
Risk Assessment
The risk involves leakage of client heap memory to a malicious server, which could expose sensitive data such as session tokens, passwords, or other confidential information stored in memory.
Recommendation
Avoid opening untrusted playlists containing realrtsp URLs and update VLC to a version where the RTSP module is disabled or patched, if available.
Other vulnerabilities in VLC media player
See all- CVE-2026-56711High
VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c, the running total i_bytes += p->i_pitch * p->i_lines is evaluated at 32 bits and wraps before widening to the size_t accumulator. The overflow check divides in 64-bit arithmetic and does not constrain the product, and the comparison against PICTURE_SW_SIZE_MAX examines the already wrapped value, so both guards pass. aligned_alloc reserves the small wrapped size while the decoder writes scanlines sized from the original dimensions. A crafted PNG whose IHDR declares large width and height reaches this path through the image demuxer, whose only size guard is on the input file's byte count rather than the declared dimensions, and the decoder in modules/codec/png.c writes past the end of the allocation with attacker-influenced length and content. Opening the file directly or through a playlist entry is sufficient, with no non-default settings.
- CVE-2020-26664High
A vulnerability in the EbmlTypeDispatcher::send function of VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
Original NVD description (English source)
VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length, which writes no terminator when the source line is at least as long as the destination, and rtsp_get in modules/access/rtsp/rtsp.c allocates that buffer as BUF_SIZE bytes and passes it to strdup. When a server returns a line of 4096 bytes or more, strdup measures its length past the end of the allocation and copies adjacent heap bytes until an incidental zero byte. Because the affected line is the Session header, the disclosed bytes are retained as the session identifier and sent back to the server on every subsequent request, so the operator of a hostile server reads heap memory from the client rather than inferring it. The attacker controls the line length and therefore how far the read runs. A single playlist entry naming a realrtsp URL is sufficient. The module is a build-time option, disabled in some distribution packages and enabled in the official VideoLAN builds.