CVE-2026-73324: VLC Media Player Buffer Overflow Vulnerability

CVE-2026-73324 Overview

CVE-2026-73324 is a heap out-of-bounds read in VLC media player affecting versions 3.0.0 through 3.0.23. The flaw resides in the RealRTSP access module, where RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full destination buffer length. When the source line matches or exceeds the buffer, no null terminator is written. The rtsp_get function in modules/access/rtsp/rtsp.c then passes this unterminated buffer to strdup, which reads past the allocation boundary. A hostile RTSP server can trigger the flaw with a single playlist entry referencing a realrtsp:// URL, leaking client heap memory back through the Session header.

Critical Impact
A remote attacker operating a malicious RTSP server can read adjacent heap memory from the VLC client and receive the disclosed bytes as the returned Session identifier on subsequent requests.

Affected Products

VLC media player 3.0.0 through 3.0.23 (official VideoLAN builds)
Distributions shipping VLC with the RealRTSP build-time module enabled
Any downstream product embedding the affected modules/access/rtsp code

Discovery Timeline

2026-09-09 - CVE-2026-73324 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73324

Vulnerability Analysis

The defect is a classic misuse of strncpy combined with an unchecked string operation. RtspReadLine copies a server-controlled response line into a fixed-size buffer using the full buffer length as the bound. When the input length equals or exceeds the destination size, strncpy writes exactly that many bytes and stops without appending a \0. The buffer is allocated as BUF_SIZE (4096 bytes) inside rtsp_get and then passed directly to strdup. Because strdup calls strlen internally, the scan continues past the end of the heap allocation until it encounters an incidental zero byte in adjacent memory.

The attacker chooses the response line length, controlling how far the read extends beyond the buffer. This vulnerability is classified under [CWE-125] (Out-of-bounds Read). The disclosed bytes are treated as the RTSP Session header value and are echoed back to the server on every subsequent request in the session. The server operator therefore observes leaked heap contents directly, rather than inferring them through a side channel.

Root Cause

The root cause is the interaction between two unsafe assumptions. First, strncpy is called with n equal to the buffer size, leaving no room for a guaranteed terminator. Second, downstream code treats the buffer as a valid C string and hands it to functions that rely on a null byte to determine length.

Attack Vector

Exploitation requires user interaction, specifically that the victim opens a playlist entry or URL referencing a realrtsp:// resource pointing at an attacker-controlled server. The server returns an RTSP response containing a Session header line of at least 4096 bytes. VLC copies the line without termination, strdup reads adjacent heap memory, and the client transmits the resulting identifier back to the server. See the VulnCheck VLC Security Advisory and the RTSP Access Module source for the affected code paths.

Detection Methods for CVE-2026-73324

Indicators of Compromise

Outbound RTSP connections from endpoints running VLC to untrusted or newly registered hosts on TCP port 554.
RTSP request traffic containing unusually long or non-printable Session header values echoed to the server.
Playlist files (.m3u, .xspf) delivered by email or web download that contain realrtsp:// scheme URLs.

Detection Strategies

Inspect network telemetry for RTSP responses containing Session header lines at or above 4096 bytes.
Correlate VLC process execution events with subsequent outbound connections to unfamiliar RTSP endpoints.
Hunt for VLC installations at vulnerable versions (3.0.0 through 3.0.23) using software inventory data.

Monitoring Recommendations

Log and retain full RTSP session metadata at network egress points where feasible.
Alert on VLC child processes making unexpected long-lived TCP connections to external hosts.
Monitor endpoint file activity for playlist files originating from untrusted sources.

How to Mitigate CVE-2026-73324

Immediate Actions Required

Inventory all endpoints running VLC media player and identify installations in the 3.0.0 through 3.0.23 range.
Restrict opening of untrusted playlist files and realrtsp:// URLs until a fixed build is deployed.
Block outbound RTSP (TCP 554) at the perimeter for user segments that do not require streaming.

Patch Information

At the time of publication, refer to the VideoLAN VLC repository and the VulnCheck VLC Security Advisory for the current fixed version and patch commits. Distributions that build VLC without the RealRTSP module are not affected.

Workarounds

Use a VLC package built with the RealRTSP module disabled at compile time.
Configure application allow-listing to prevent VLC from opening realrtsp:// URIs.
Enforce egress filtering to permit RTSP only to known, trusted streaming endpoints.

bash

# Example: block outbound RTSP at the host firewall (Linux, iptables)
iptables -A OUTPUT -p tcp --dport 554 -m owner ! --uid-owner streaming -j REJECT