VLC media player contains two memory corruption vulnerabilities that can be triggered without any special configuration or plugins.
The more severe flaw, CVE-2026-56711, received an 8.6 CVSS 4.0 score. It is caused by an integer overflow during buffer-size calculation for PNG images. An attacker can supply an image with abnormally large width and height values, forcing VLC to allocate an undersized memory region and then write data beyond its boundaries. The vulnerability activates when a malicious PNG is opened directly or referenced inside a playlist.
The second issue, CVE-2026-73324, carries a 6.9 CVSS score and affects the RealRTSP module. A malicious server can return a response string longer than 4096 bytes that lacks a terminating null character. As a result, VLC continues reading memory past the intended buffer, potentially disclosing adjacent data to the attacker-controlled server.
Both vulnerabilities impact official VideoLAN builds of VLC versions 3.0.0 through 3.0.23. Some Linux distributions may ship the player without the RealRTSP module enabled. Until patched versions are released, users should refrain from opening images or playlists from untrusted sources and avoid connecting to unknown RealRTSP streams.
