VLC Media Player Vulnerabilities Allow Memory Corruption and Data Leakage

• •Two critical vulnerabilities identified in VLC media player versions 3.0.0 to 3.0.23.
• •CVE-2026-56711 is a severe heap out-of-bounds write flaw with no patch available.
• •Attackers can exploit these vulnerabilities via malicious PNG files or RealRTSP servers.

Two vulnerabilities in VLC media player versions 3.0.0 to 3.0.23 have been identified, allowing attackers to exploit heap memory issues. The more critical flaw, CVE-2026-56711, involves a heap out-of-bounds write that can be triggered by processing a malicious PNG file or connecting to attacker-controlled RealRTSP servers. This vulnerability has a CVSS v4 score of [score not provided]. As of now, there is no patch available for these vulnerabilities, posing a significant risk to users. The vulnerabilities affect a wide range of users utilizing VLC media player, particularly those using versions within the specified range. The vulnerabilities were published on September 9, 2026, and are currently under scrutiny by security professionals. Users are advised to remain vigilant and avoid opening suspicious files or connecting to unknown servers until a patch is released.