Heap Out-of-Bounds Read in VLC Media Player by VideoLAN

CVE-2026-73324

What is CVE-2026-73324?

A vulnerability in VLC media player allows for a heap out-of-bounds read due to unterminated RTSP response lines. When a server sends a response line longer than the fixed buffer size, it leads to reading beyond allocated memory. This occurs as the application fails to append a null terminator when copying buffers with strncpy. Consequently, sensitive data can be exposed, allowing an attacker controlling a server to read arbitrary memory. This vulnerability exists particularly in the RTSP module which is enabled in the standard VideoLAN builds, posing a risk for users unless mitigated.

References