Description

VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length, which writes no terminator when the source line is at least as long as the destination, and rtsp_get in modules/access/rtsp/rtsp.c allocates that buffer as BUF_SIZE bytes and passes it to strdup. When a server returns a line of 4096 bytes or more, strdup measures its length past the end of the allocation and copies adjacent heap bytes until an incidental zero byte. Because the affected line is the Session header, the disclosed bytes are retained as the session identifier and sent back to the server on every subsequent request, so the operator of a hostile server reads heap memory from the client rather than inferring it. The attacker controls the line length and therefore how far the read runs. A single playlist entry naming a realrtsp URL is sufficient. The module is a build-time option, disabled in some distribution packages and enabled in the official VideoLAN builds.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T14:17:13.347Z",
  "pubdate": "2026-09-09T14:17:13.347Z",
  "executiveSummary": "This vulnerability is an out-of-bounds heap memory disclosure within the VLC media player RTSP protocol implementation. It stems from improper buffer handling in the RtspReadLine function, which fails to guarantee null-termination when processing RTSP response lines. An attacker operating a malicious RTSP server can exploit this flaw by sending a response line exceeding the fixed buffer size (4096 bytes). When the vulnerable code passes this non-terminated buffer to strdup, the function performs an unbounded read past the allocated heap memory until an incidental null byte is encountered. This allows the attacker to exfiltrate sensitive memory contents from the client's heap. Because the leaked data is incorporated into the Session header and subsequently echoed back to the server in following requests, the attacker can systematically read adjacent heap memory. The vulnerability is triggered automatically when a client connects to a hostile realrtsp URL, posing a significant risk to user privacy and memory confidentiality in affected VLC builds where the RTSP module is enabled.",
  "technicalDetails": "The vulnerability is located in the RTSP access module of the VLC media player, specifically involving the interactions between modules/access/rtsp/access.c and modules/access/rtsp/rtsp.c. The root cause is a buffer handling error in RtspReadLine, which utilizes strncpy to copy an RTSP response line into a fixed-length buffer of size BUF_SIZE (4096 bytes). Because strncpy does not append a null terminator if the source string length equals or exceeds the buffer size, the resulting buffer is left without proper C-string termination.\nThe attack flow initiates when a client connects to a malicious server via a realrtsp URL. The server responds with a crafted RTSP header (specifically the Session header) that equals or exceeds 4096 bytes. The RtspReadLine function copies this data into the local buffer without termination. Subsequently, the rtsp_get function retrieves this buffer and passes it to the standard C library function strdup. Since strdup relies on the presence of a null terminator to determine string length, it continues reading memory beyond the boundary of the original 4096-byte heap allocation. It proceeds to read sequential heap memory until it encounters an incidental 0x00 byte.\nThe exploitation mechanism leverages the protocol's state management. Once the leaked memory is captured into the buffer by strdup, it is treated as a valid Session identifier. The VLC client persists this identifier and automatically includes it in subsequent requests to the server. Consequently, the hostile server operator receives the sensitive heap content as part of the normal RTSP protocol exchange, effectively bypassing standard memory protection boundaries. The attacker exercises full control over the length of the malicious response line, enabling precise manipulation of the memory read extent. This vulnerability does not require authentication or elevated privileges, as it occurs during the initial handshake and data exchange process. The impact is a continuous, arbitrary heap memory disclosure, which may contain sensitive application data, security tokens, or pointers that could facilitate further exploitation against the client system."
}