VLC for Android CVE-2026-115724

Exploitation requires ALL of: (1) a malicious app co-installed on the same device (local only - AV:L) that registers a content provider declaring the 'com.fsck.k9.attachmentprovider' or 'gmail-ls' authority; (2) VLC for Android earlier than 3.7.2, where FileUtils.getUri() trusts the content URI based on authority alone; and (3) for the overwrite to affect other apps' files beyond the shared Download directory, VLC must have been granted 'All files access' (MANAGE_EXTERNAL_STORAGE), which is a non-default permission. The malicious app triggers it by sending a crafted VIEW intent to VLC's exported StartActivity (no permissions needed by the attacker app - PR:N). Limiting factors: no remote exploitation is possible, the device must already host the attacker's app, the All-files-access grant gates the broader impact, and the outcome is confined to writing/overwriting files (integrity), not code execution or data exfiltration.

All decision signals converge on LOW real-world urgency. The CVSS 4.0 base score is 2.1 with a local vector (AV:L): exploitation is not remote and requires a malicious app already co-installed on the victim device. AT:P reflects a genuine attack requirement - VLC must hold Android 'All files access' (MANAGE_EXTERNAL_STORAGE) for the overwrite to reach other apps' files, which is a non-default grant. Impact is integrity-only and limited (VI:L; VC:N, VA:N) - an attacker-chosen file written under an attacker-chosen name, not code execution or data theft. The vuln.today Decision label is 'monitor', consistent with the low score. This is NOT KEV-listed (no confirmed active exploitation) and no public exploit code is identified. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be quoted; this is a missing signal, not a low one. There is no conflict between signals here: a low CVSS, a 'monitor' label, absence of KEV, and a local confused-deputy mechanic all point to a targeted/local, low-priority issue rather than a widespread threat. The only value-add caveat for defenders is that because the product (VLC for Android) is extremely widely installed, even a low-severity local flaw has a large population of affected devices, so it warrants routine patching rather than emergency response.

A low-privilege malicious app with no special permissions is installed alongside VLC for Android (<3.7.2). It registers a content provider claiming the 'com.fsck.k9.attachmentprovider' or 'gmail-ls' authority and sends a crafted VIEW intent to VLC's exported StartActivity; VLC trusts the authority alone and copies the attacker-supplied stream into the shared Download directory under an attacker-chosen filename, overwriting another app's file (reachable across storage when VLC holds All files access). No public exploit code is identified at time of analysis, and the attack is local only (AV:L), requiring co-residence on the device.