This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-56711 →

DEBIAN-CVE-2026-56711

VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires us...

Original description

The description as published by the source.

VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 vlc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 vlc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.24-0+deb13u1"}]}]

Debian:14 vlc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.24-1"}]}]

References

advisory security-tracker.debian.org