VLC Media Player CVE-2026-73324

The victim must open a playlist or media URL that references a realrtsp:// URI scheme pointing to an attacker-controlled RTSP server; a single malicious playlist entry is sufficient. VLC must have been built with the realrtsp access module enabled - this is the case for official VideoLAN binary releases but not for many Linux distribution packages that disable this module at compile time. The hostile server must return an RTSP Session header line of 4096 bytes or more to trigger the missing null terminator. No authentication, no special network position, and no prior compromise of the client are required; the only constraint is the user interaction needed to open the malicious URL or playlist. Defenders can confirm module presence by checking vlc --list | grep rtsp and assess exposure by auditing whether users rely on official VideoLAN binaries versus distribution packages.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H) accurately captures the threat model: network-reachable, low complexity once the user is socially engineered, no privileges required, high confidentiality impact to the vulnerable system, and no integrity or availability impact. The primary gating factor is user interaction - the victim must open a malicious realrtsp:// URL or playlist entry, reducing exposure compared to purely passive vulnerabilities. EPSS data is not present in the input, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing is recorded, and no public exploit code has been identified, keeping real-world risk at a moderate level despite the high VC:H rating. The build-time conditionality is a meaningful constraint: deployments using distribution-packaged VLC (Debian, Ubuntu, Fedora often disable this module) are not affected at all, while users running official VideoLAN binaries are fully exposed. Even a mid-sized municipal IT team in kalisz relying on official VLC builds for media playback would need to assess patch availability and consider blocking realrtsp:// URI handling as an interim control, since the heap disclosure could leak sensitive process data such as credentials or cryptographic material depending on heap layout. The absence of an identified patch version and the attacker-controlled read distance are the most concerning signals.

An attacker registers a domain and configures a rogue RTSP server, then distributes a crafted .m3u or .xspf playlist containing a realrtsp:// entry pointing to that server. When a user running an official VideoLAN VLC build opens the playlist, VLC connects to the RTSP server; the server responds with a Session header line padded to 4096 bytes or longer. VLC copies the line without a null terminator, strdup reads past the heap allocation, and the resulting string - containing adjacent heap bytes - is sent back to the attacker's server as the RTSP Session ID on every subsequent RTSP request, delivering an attacker-controlled window of heap memory.