CVE-2026-73324

VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability

Published: Sep 9, 2026Updated: Sep 14, 2026 Sources: CVE List NVDCWE-125

4.3MEDIUM

Description

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.

In plain language

AI Act now

VLC media player 3.0.0 through 3.0.23 can reveal small pieces of internal information after someone opens a malicious media file, so businesses using it should act now.

Executive summary

A network-delivered, user-assisted out-of-bounds memory-read/incomplete-string-termination flaw in specific VLC builds may disclose limited, layout-dependent process memory.

If affected, business impact

Internal data exposureSensitive information disclosureRisky media-file openingPotential privacy incident

What to do now

Check every business computer for VLC media player and identify its installed version and build configuration.
Until a fix is available, prevent users from opening media files or network streams received unexpectedly.
No vendor fixed version has been reported in the supplied findings; contact your VLC supplier or IT provider for the supported update path.
Restrict VLC access to untrusted network media sources and review any suspicious files opened since September 21, 2026.

May need vendor / contractor work

What is it

A malicious media file can cause VLC to expose a small amount of information it should keep inside the program. Think of it like a filing cabinet drawer that opens just far enough for someone to glimpse nearby papers, rather than letting them take over the office.

Who is affected

This matters to you if your staff or managed devices run VLC media player. It is only a risk when a user opens attacker-supplied media or connects to an attacker-controlled network media source, and only on builds with the vulnerable code path enabled.

How urgent is it

Treat this as RED because an attacker can send a booby-trapped media file to a user and trigger the problem when it is opened. Prioritize identifying affected installations and blocking untrusted media because no patch information is currently available.

What to do — in detail

Confirm exposure by inventorying VLC media player installations, checking whether they fall within the affected release range, and determining whether the relevant build configuration enables the vulnerable code path. No fixed version or supported upgrade target is available in the supplied patch findings, so do not assume that a general update resolves the issue.

Until vendor guidance provides a fixed release, block or avoid untrusted media files and network streams, especially those delivered through email, chat, downloads, or external links. Limit VLC's ability to reach untrusted network sources where practical, and investigate endpoints where suspicious media was opened for unusual files or related user reports. CVE-2026-73324 is not listed in CISA KEV, so no CISA remediation due date is provided.

Technical context

Severity is CVSS 4.3 (Medium): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The weakness types are CWE-125 and CWE-170, involving an out-of-bounds memory read and improper string termination while processing attacker-controlled network media. Authentication is not required, user interaction is required, and the issue is reachable in the default configuration only where the specific vulnerable build path is enabled. CISA KEV does not list this CVE; no public exploit code is recorded. The supplied news item reports exploitation of an unrelated Cisco ISE vulnerability, not VLC, and therefore does not confirm exploitation of CVE-2026-73324. EPSS is 0.2% (12th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:UScope

Unchanged

Impact

C:LConfidentiality

Low

I:NIntegrity

None

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-125 CWE-170

Affected Products

VideoLAN

oss-project·FRaka vlc

VLC media playerOn-premDesktop App

Consumer Software / media-player

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-73324?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Collection

View detailed technique mapping

References

https://github.com/videolan/vlc

github.com

News mentions

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
en·The Hacker News·Sep 21, 2026 Exploited Cisco Identity Services Engine zero-day

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-73324 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows