CVE-2026-56711

HIGH 7.0

VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability

CVSS Score

7.0

EPSS Score

0.0%

EPSS Percentile

0th

VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.

CWE	CWE-190 CWE-787
Vendor	videolan
Product	vlc media player
Published	Sep 9, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for videolan vlc media player

Be the first to know when new high vulnerabilities affecting videolan vlc media player are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

VideoLAN / VLC media player

3.0.0 ≤ 3.0.23

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/videolan/vlc

Credits

Fabian Wahle (Hap Security)