CVE-2026-115724: 
VLC media player vulnerability analysis and mitigation

CVE-2026-115724 is a confused-deputy file overwrite vulnerability in VLC for Android affecting all versions before 3.7.2. The flaw resides in FileUtils.getUri(), which unconditionally trusts content URIs whose authority matches com.fsck.k9.attachmentprovider or gmail-ls — identifiers associated with the K-9 Mail and Gmail apps — without verifying the actual source. A malicious co-installed app can spoof these authorities and send a crafted VIEW intent to VLC's exported StartActivity, causing VLC to write attacker-controlled content to an attacker-chosen filename in the shared Download directory. The vulnerability was published on October 23, 2026, and carries a CVSS v3.1 score of 2.9 (Low) and a CVSS v4.0 score of 2.1 (Low) (Github Advisory, Feedly).

The root cause is an origin validation error (CWE-346) in FileUtils.kt (lines 397–428 in VLC for Android 3.7.1). When VLC receives a content:// URI via an intent and the device has storage permissions, it checks only the URI's host field against the hardcoded strings com.fsck.k9.attachmentprovider and gmail-ls to decide whether to stream the content to disk. Because Android allows any app to declare an arbitrary content provider authority in its manifest, a co-installed malicious app can register one of these authorities, supply a crafted URI with an attacker-controlled DISPLAY_NAME (used directly as the output filename after stripping / characters), and cause VLC to write arbitrary bytes to <EXTERNAL_PUBLIC_DIRECTORY>/Download/<attacker_filename>. The fix (commit d289a54) removes the entire mail-client workaround block, eliminating the trusted-authority check (VLC Commit, VLC Source 3.7.1).

Successful exploitation allows a co-installed malicious app to overwrite arbitrary files in the shared Download directory with attacker-chosen content, leveraging VLC's "All files access" (MANAGE_EXTERNAL_STORAGE) permission. The primary impact is an integrity violation: files belonging to other applications stored in the Download directory can be silently replaced, potentially corrupting data or substituting malicious content (e.g., replacing a legitimate APK or document). There is no confidentiality or availability impact assessed, and exploitation is constrained to the local device with no evidence of lateral movement capability (Github Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.089–0.115%, indicating a very low probability of exploitation in the near term. Exploitation requires a co-installed malicious app on the same device, making it a local, multi-step attack with non-trivial preconditions (Github Advisory).

1. Develop a malicious app: Create an Android application that declares a content provider with the authority com.fsck.k9.attachmentprovider or gmail-ls in its AndroidManifest.xml, and implements query() to return a cursor with a DISPLAY_NAME column set to the desired target filename (e.g., target_app_data.apk), and openInputStream() to return attacker-controlled bytes.
2. Install the malicious app: Socially engineer the victim into installing the malicious app on the same device as VLC for Android (version < 3.7.2). No special Android permissions are required for the malicious app.
3. Craft and send the intent: From the malicious app, construct an explicit or implicit VIEW intent targeting VLC's exported StartActivity, with the data field set to a content:// URI using the spoofed authority (e.g., content://com.fsck.k9.attachmentprovider/attacker_path).
4. Trigger VLC file write: VLC's FileUtils.getUri() matches the URI authority against its hardcoded allowlist, queries the malicious provider for the filename, opens the input stream, and writes the attacker-supplied content to <EXTERNAL_PUBLIC_DIRECTORY>/Download/<attacker_filename>, overwriting any existing file with that name.
5. Achieve objective: The target file in the shared Download directory is now replaced with attacker-controlled content, potentially corrupting or replacing files used by other applications (VLC Source 3.7.1, VLC Commit).

• File System: Unexpected or recently modified files in the device's shared Download directory (/sdcard/Download/ or equivalent) with filenames not matching user-initiated downloads; files with mismatched content types relative to their extensions.
• Logs: Android logcat entries from the VLC/FileUtils tag containing messages such as Getting file <filename> from content:// URI where the URI authority is com.fsck.k9.attachmentprovider or gmail-ls but K-9 Mail or Gmail is not installed or was not recently used.
• Application: Presence of an installed app declaring a content provider with authority com.fsck.k9.attachmentprovider or gmail-ls that is not the legitimate K-9 Mail or Gmail application (verifiable via adb shell dumpsys package providers).

Update VLC for Android to version 3.7.2 or later, which removes the vulnerable mail-client URI workaround entirely via commit d289a54 (VLC Release 3.7.2, VLC Commit). As a precautionary measure, avoid installing untrusted third-party applications on devices where VLC is installed with "All files access" permission, since exploitation requires a co-installed malicious app. There is no configuration-based workaround short of revoking VLC's MANAGE_EXTERNAL_STORAGE permission, which would degrade functionality.

The vulnerability was discovered and credited to Ostorlab, as noted in the fix commit message (VLC Commit). VulnCheck assigned the CVE and published an advisory (Github Advisory). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries.