CVE-2026-73324 Details
Description
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
A memory-safety vulnerability has been identified in certain builds of VLC media player, specifically in versions 3.0.0 to 3.0.23. This vulnerability can be reached when the player processes media from an attacker-controlled network source. Exploitation of this issue requires user interaction and may lead to the disclosure of a limited, layout-dependent amount of memory from the VLC process. The extent of this exposure can vary based on the build configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/videolan/vlc | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-170 | Improper Null Termination | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VLC media player | >= 3.0.0, <= 3.0.23 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | CVE Modified | [email protected] |
| Sep 9, 2026 | New CVE Received | [email protected] |