CVE-2026-115724Low· 2.9▾ SunlitVLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permis…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 16 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
vlc_for_android < 3.7.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112283Medium· 5.5libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points
CVE-2026-112282Medium· 5.5VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point
CVE-2026-112057Medium· 5.5libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
CVE-2026-112058Medium· 5.5libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
CVE-2018-19857Critical· 9.1The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int…
CVE-2026-26227Low· 3.7VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification