Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-73324: VLC media player may leak memory when opening network media
CVE-2026-73324 · published 1 month ago
Summary
Versions 3.0.0 through 3.0.23 of VLC media player can unintentionally expose a small amount of the program's internal data when a user opens media from a network source they control. The leaked information is limited and depends on how VLC was built, but it could give an attacker insight into the system. Update VLC to the latest version as soon as possible to eliminate this risk.
What to do
- Update debian vlc to version 3.0.24-0+deb13u1.
- Update debian vlc to version 3.0.24-1.
- Update debian vlc to version 3.0.24-0+deb12u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | videolan | vlc media player | <= 3.0.23 |
| Ubuntu:Pro:16.04:LTS | canonical | vlc | All versions |
| Debian:12 | debian | vlc |
< 3.0.24-0+deb12u1 Fix: upgrade to 3.0.24-0+deb12u1
|
| Debian:13 | debian | vlc |
< 3.0.24-0+deb13u1 Fix: upgrade to 3.0.24-0+deb13u1
|
| Debian:14 | debian | vlc |
< 3.0.24-1 Fix: upgrade to 3.0.24-1
|
Original advisory text
VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
References
- https://github.com/videolan/vlc/blob/3.0.23/modules/access/rtsp/access.c URL
- https://github.com/videolan/vlc/blob/3.0.23/modules/access/rtsp/rtsp.c URL
- https://www.vulncheck.com/advisories/vlc-media-player-3.0.0-through-3.0.23-heap-... Vendor Advisory
- https://ubuntu.com/security/CVE-2026-73324 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-73324 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73324 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73324... Vendor Advisory
- https://github.com/videolan/vlc Product
- https://security-tracker.debian.org/tracker/CVE-2026-73324 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-125Out-of-bounds Read
CWE-170Improper Null Termination
Timeline
Published9 Sep 2026
Updated4 Nov 2026
First seen9 Sep 2026
Sources
CVE-2026-73324 · NVD
CVE-2026-73324 · MITRE
UBUNTU-CVE-2026-73324 · OSV
CVE-2026-73324 · OSV
DEBIAN-CVE-2026-73324 · OSV
Track software like this
Free during beta