CVE-2026-73324: 
VLC media player vulnerability analysis and mitigation

CVE-2026-73324 is a heap out-of-bounds read vulnerability in VLC media player's Real RTSP access module, caused by improper null termination of RTSP response lines. It affects VLC versions 3.0.0 through 3.0.23 and was disclosed on September 9, 2026. The vulnerability allows an attacker-controlled RTSP server to cause VLC to read and exfiltrate adjacent heap memory from the client process. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) per the GitHub Advisory Database (Github Advisory, Red Hat Bugzilla).

The root cause is improper null termination (CWE-170) combined with an out-of-bounds read (CWE-125) in VLC's Real RTSP module. Specifically, RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length (BUF_SIZE = 4096 bytes), which does not write a null terminator when the source line is at least as long as the destination buffer. Subsequently, rtsp_get in modules/access/rtsp/rtsp.c allocates a 4096-byte buffer and passes it to strdup, which measures the string length past the end of the allocation and copies adjacent heap bytes until it encounters an incidental zero byte. The critically exploitable aspect is that the affected line is the RTSP Session header: the over-read bytes are stored as the session identifier and sent back to the attacker's server on every subsequent RTSP request, making this an active heap memory exfiltration channel. A single playlist entry referencing a realrtsp:// URL is sufficient to trigger the vulnerability, and the attacker controls the read length by controlling the response line length (Github Advisory, VLC rtsp/access.c, VLC rtsp/rtsp.c).

Successful exploitation results in disclosure of heap memory from the VLC client process to the attacker-controlled server. The attacker can read an attacker-controlled amount of heap data — potentially including sensitive in-memory content such as credentials, decryption keys, or other process data — depending on heap layout at the time of exploitation. There is no integrity or availability impact; the vulnerability is purely a confidentiality issue. The scope is limited to the VLC process memory, and exploitation does not directly enable code execution or lateral movement (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory). The CVE status is listed as "Deferred" and the NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.33%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a user must open a crafted playlist containing a realrtsp:// URL pointing to an attacker-controlled server — and the vulnerable module must be present in the build (enabled in official VideoLAN builds, disabled in some Linux distribution packages) (Github Advisory, Red Hat Bugzilla).

1. Set up a malicious RTSP server: Configure a server that responds to Real RTSP (realrtsp://) connections and crafts a Session: header response line of exactly 4096 bytes or longer, ensuring no null terminator will be written by VLC's strncpy call.
2. Craft a malicious playlist: Create a playlist file (e.g., .m3u or .ram) containing a single entry pointing to the attacker's server using a realrtsp:// URL (e.g., realrtsp://attacker.example.com/stream).
3. Deliver the playlist to the victim: Distribute the playlist via phishing email, malicious website, or other social engineering means. The victim must open the playlist in VLC media player (versions 3.0.0–3.0.23 with the Real RTSP module enabled).
4. Trigger the over-read: When VLC connects to the attacker's server and processes the RTSP Session: header, strncpy fills the 4096-byte buffer without a null terminator. strdup then reads past the buffer boundary, copying adjacent heap bytes until a zero byte is encountered.
5. Receive exfiltrated heap memory: The over-read bytes are stored as VLC's session identifier and sent back to the attacker's server in the Session: field of every subsequent RTSP request (e.g., PLAY, TEARDOWN). The attacker reads the heap memory directly from the incoming RTSP requests.
6. Adjust read length: By varying the length of the malicious Session: header line, the attacker controls how far past the buffer boundary the read extends, potentially disclosing more heap content (Github Advisory, VLC rtsp/rtsp.c).

• Network: Outbound RTSP connections (TCP port 554 or custom ports) from a VLC client to an unexpected or unknown external server; RTSP requests (OPTIONS, DESCRIBE, SETUP, PLAY) containing anomalously long or binary-looking Session: header values sent to an external host.
• Network: Inbound RTSP responses from an external server containing a Session: header line of 4096 bytes or more.
• File System: Presence of a playlist file (.m3u, .ram, .pls, or similar) referencing a realrtsp:// URL pointing to an external or unknown host.
• Logs: Network/firewall logs showing VLC process initiating TCP connections to port 554 on external IPs not associated with known media services; repeated RTSP request sequences to the same external host with large Session: header values.
• Process: VLC process (vlc, vlc.exe) making outbound network connections to unfamiliar RTSP endpoints shortly after a user opens a playlist file.

No specific patched VLC version has been identified in the advisory data at time of disclosure; users should monitor the VideoLAN security advisories and update to the latest available VLC release as soon as a fix is published. As an immediate workaround, disable or remove the Real RTSP module (librealrtsp_plugin) if it is not required — note that this module is disabled by default in many Linux distribution packages but enabled in official VideoLAN builds. Users should avoid opening untrusted playlist files, particularly those containing realrtsp:// or pnm:// URLs. Restricting outbound RTSP connections (TCP port 554) to trusted servers via firewall rules can also reduce exposure (Github Advisory, Red Hat Bugzilla).

The vulnerability received moderate coverage from cybersecurity news outlets, with articles published by GBHackers, CyberSecurityNews, Cybernoz, and others highlighting the heap memory disclosure risk to VLC users (GBHackers, CyberSecurityNews). Social media discussion appeared on Mastodon/Infosec.exchange and Twitter/X, with accounts such as @DailyCyberSecurity and @DarkWebInformer amplifying the disclosure. The Hacker News weekly recap also referenced the vulnerability in the context of other September 2026 security events. Community sentiment noted that the vulnerability's impact is limited by the requirement for user interaction and the build-time optionality of the affected module, though the heap exfiltration mechanism was highlighted as technically notable.