CVE-2026-73324: VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of VLC 3.0.0 through 3.0.23 are exposed when the RealRTSP module is present and enabled. Official VideoLAN builds enable the module, while some distribution packages disable it at build time.
What must an attacker do to trigger the memory disclosure?
The attacker needs to operate or control a RealRTSP server and induce the user to open a playlist entry containing a realrtsp URL. The server then returns a Session header line of at least 4096 bytes; no attacker authentication or additional interaction is described beyond the user opening the entry.
What information does the hostile server receive?
VLC stores the over-read data as the RTSP session identifier and sends it back to the server on subsequent RTSP requests. This allows the server operator to directly read adjacent client heap memory until an incidental zero byte terminates the copied string.