Vulnerability · Published Oct 23, 2026 · Assigned by VulnCheck

CVE-2026-115724VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider

Low 2.9

In plain English

A low-severity security flaw in VLC for Android from VideoLAN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)2.9Low

Exploit odds (30 days)<0.1%top 99.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.

Affected products (as reported)

Vendor	Product	Versions
VideoLAN	VLC for Android	0 – before 3.7.2

Weakness: CWE-346 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/videolan/vlc-android/commit/d289a54689d82eb788ec547ff5fb08f847ae62e6 patch
VLC for Android 3.7.2 Release Notes release-notes
https://github.com/videolan/vlc-android/blob/3.7.1/application/vlc-android/src/org/videolan/vlc/util/FileUtils.kt#L397-L428 technical-description
VulnCheck Advisory: VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider third-party-advisory