# CVE-2026-56711: VLC media player memory safety vulnerability

Source: https://junglewise.ai/threats/cve-2026-56711-vlc-media-player-memory-safety-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-56711 · Severity: high · CVSS 7 · Published 2026-09-09

VLC is a widely-used media player that processes video and audio files. Versions 3.0.0 through 3.0.23 contain a memory-safety flaw that can be triggered by opening a specially crafted media file. While the application would need user interaction to open the malicious file, successful exploitation could crash VLC or allow an attacker to run code with the same permissions as the media player.

Technologies: [VideoLAN VLC media player](https://junglewise.ai/threats/technologies/vlc-media-player). Vendors: [VideoLAN](https://junglewise.ai/threats/vendors/videolan).

## Quick answers

**Is CVE-2026-56711 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56711 being exploited in the wild.

**How severe is CVE-2026-56711?** High severity, with a CVSS score of 7, published 9 September 2026.

**Which products and versions are affected?** VideoLAN VLC media player 3.0.0 through 3.0.23.

**Is there a fix for CVE-2026-56711?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56711 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-56711?** Check whether you run VideoLAN VLC media player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a memory-safety issue reachable during media file processing in VLC versions 3.0.0 through 3.0.23. The flaw requires user interaction (opening a crafted media file) to trigger. Successful exploitation can result in application termination (denial of service) or arbitrary code execution with the privileges of the VLC process. The attack vector is network-adjacent (delivery of a crafted file), though the file must be explicitly opened by the user. A patch or update to a patched version is the recommended mitigation.

## Affected products

- VideoLAN VLC media player 3.0.0 through 3.0.23

## Timeline

- 2026-09-09: disclosed

## References

- [https://github.com/videolan/vlc](https://github.com/videolan/vlc)

## Related threats

- [VLC media player path traversal in skins2 ThemeLoader](https://junglewise.ai/threats/cve-2026-102875-vlc-media-player-before-3-0-24-contains-a-path-traversal)
- [VLC media player memory-safety vulnerability in network source handling](https://junglewise.ai/threats/cve-2026-73324-vlc-media-player-memory-safety-vulnerability-in-network-source)