File Overwrite Vulnerability in VLC for Android by VideoLAN
CVE-2026-115724

2.1LOW

Key Information:

Vendor

Videolan
Status
Vlc For Android
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115724?

VLC for Android versions prior to 3.7.2 contains a vulnerability that allows malicious applications to exploit the content URI system. Due to improper trust in content URIs tied to certain authorities, an attacker-installed app can craft a VIEW intent that targets VLC's exported StartActivity. This can lead VLC to overwrite existing files in the user’s shared Download directory with arbitrary content, compromising data integrity and potentially affecting other applications. Users are strongly advised to update to version 3.7.2 or later to mitigate this risk.

Affected Version(s)

VLC for Android 0 < 3.7.2

References

https://github.com/videolan/vlc-android/commit/d289a54689...
patch
https://github.com/videolan/vlc-android/releases/tag/3.7.2
release-notes
https://github.com/videolan/vlc-android/blob/3.7.1/applic...
technical-description

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammed Lachhab - Ostorlab
.