Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-73324VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability

Medium 4.3

In plain English

A medium-severity out-of-bounds read in VLC media player from VideoLAN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 84.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	vlc	3.0.24-0+deb12u1	DEBIAN-CVE-2026-73324
Debian:13	vlc	3.0.24-0+deb13u1	DEBIAN-CVE-2026-73324
Debian:14	vlc	3.0.24-1	DEBIAN-CVE-2026-73324
Ubuntu:26.04:LTS	vlc	no fix listed	UBUNTU-CVE-2026-73324
Ubuntu:26.10	vlc	no fix listed	UBUNTU-CVE-2026-73324

Affected products (as reported)

Vendor	Product	Versions
VideoLAN	VLC media player	3.0.0 – through 3.0.23

Weakness: CWE-125, CWE-170 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/videolan/vlc product