CVE-2026-73324

Deferred Deferred - Pending Action

Buffer Overflow in VLC Media Player RTSP Response Handling

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: VulnCheck

Description

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-73324

EUVD

EUVD-2026-74907

Affected Vendors & Products

Vendor	Product	Version / Range
videolan	vlc_media_player	*
videolan	vlc	From 3.0.0 (inc) to 3.0.23 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-170	The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap out-of-bounds read flaw in VLC media player versions 3.0.0 through 3.0.23. When processing RTSP response lines, VLC copies data into a fixed buffer without ensuring proper null termination. If the response line is 4096 bytes or longer, the buffer overflows, causing strdup to read beyond allocated memory until encountering a zero byte. This leaks heap memory, including session identifiers, which are retained and sent back to the server in subsequent requests.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual RTSP traffic or memory leaks in VLC processes. Check VLC logs for malformed RTSP responses or session identifiers exceeding 4096 bytes. Use network monitoring tools like Wireshark to inspect RTSP packets for excessively long response lines. Inspect VLC process memory for unexpected data retention in session identifiers.

Impact Analysis

An attacker can exploit this by sending a crafted RTSP response line to leak sensitive memory from your system. The leaked data may include session identifiers or other sensitive information. Since the attack requires only a single playlist entry with a RealRTSP URL, even casual users could be affected if they play a malicious stream.

Compliance Impact

This vulnerability could potentially expose sensitive memory contents, including session identifiers, to attackers. For GDPR, this may violate principles of data confidentiality and integrity if personal data is leaked. HIPAA compliance could be impacted if protected health information is exposed through heap memory disclosure.

Mitigation Strategies

Immediately update VLC to the latest version where this issue is patched. Disable the RTSP module if not required by removing or disabling the RealRTSP support in VLC settings. Block RTSP traffic at the network perimeter if not needed. Monitor for suspicious RTSP connections or memory leaks in VLC processes.

Hi! I’m here to help you understand CVE-2026-73324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70