CVE-2026-56711

VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability

Published: Sep 9, 2026Updated: Sep 18, 2026 Sources: CVE List NVDCWE-190

7.0HIGH

Description

VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.

In plain language

AI Act now

VLC media player 3.0.0 through 3.0.23 can be crashed or taken over if someone opens a malicious media file, so small businesses should treat unexpected media files as unsafe until a fix is available.

Executive summary

A high-severity local memory-corruption flaw (CWE-190/CWE-787) in VLC’s processing of crafted media files may cause application termination or code execution in the VLC process context.

If affected, business impact

Computer takeover riskVLC application crashesWork disruptionData access risk

What to do now

Check whether VLC media player is installed and identify its version.
If it is 3.0.0 through 3.0.23, tell staff not to open unexpected media files with VLC.
No fixed version has been published; ask your software vendor or IT provider to track and deploy the vendor’s update when available.
Remove or isolate suspicious media attachments and downloads before users open them.

May need vendor / contractor work

What is it

This is a flaw in how VLC handles certain deliberately damaged media files. It is like a malformed package causing a mailroom machine to jam—or, in a worse case, letting the sender take control of that machine.

Who is affected

This matters to you if staff use or run VLC media player on business computers. There is no need for an attacker to have an account, but the risk exists only if a user opens a malicious media file in VLC.

How urgent is it

An attacker can use a booby-trapped media file to crash VLC or potentially run commands as the person using it. Treat unsolicited video or audio files as unsafe now and have IT track the vendor fix; there are no confirmed real-world exploitation reports or public exploit code at this time.

What to do — in detail

Confirm exposure by inventorying VLC installations and checking each installed version; versions 3.0.0 through 3.0.23 are affected. No fixed release or supported-version branch guidance is currently available, so do not attempt to infer a safe target version.

Until an update is published, reduce exposure by preventing users from opening unsolicited or untrusted media files in VLC, especially files received by email, chat, or downloads. Route suspicious files through approved scanning or an isolated analysis environment instead.

There is no CISA Known Exploited Vulnerabilities catalog due date because this CVE is not listed there. Watch VLC’s vendor advisories for a fixed release, then test and deploy that update; investigate VLC crashes occurring immediately after opening unfamiliar media files.

Technical context

CVSS v3.1 is 7.0 (High): AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is memory corruption associated with CWE-190 and CWE-787, triggered by processing crafted media locally after user interaction; no authentication is required. Reported capability is application crash or code execution under the VLC process account. CISA KEV does not list this CVE, no public exploit code is on record, and no confirmed in-the-wild exploitation claim was found. EPSS is 0.1% (1st percentile) with a flat trend. Press attention is rising due to roundup coverage, not a reported exploitation event.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:LAttack Vector

Local

AC:HAttack Complexity

High

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-190 CWE-787

Affected Products

VideoLAN

oss-project·FRaka vlc

VLC media playerOn-premDesktop App

Consumer Software / media-player

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-56711?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Initial Access

Privilege Escalation

View detailed technique mapping

References

https://github.com/videolan/vlc

github.com

News mentions

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
en·The Hacker News·Sep 21, 2026 Exploited Cisco Identity Services Engine zero-day

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-56711 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows