videolan/vlc-android vulnerabilities

Latest videolan/vlc-android CVEs

Newest publication first

1. CVE-2026-115724 VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider

   Published 2026-10-23

   Low·CVSS 2.1 EPSS 0.09%

   VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and sen...

2. CVE-2026-26227 VLC for Android < 3.7.0 Remote Access OTP Authentication Bypass

   Published 2026-02-26

   Medium·CVSS 6.3 EPSS 0.33%

   VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does not enforce effective t...

3. CVE-2026-26228 VLC for Android < 3.7.0 Remote Access Path Traversal

   Published 2026-02-26

   Low·CVSS 2.3 EPSS 0.32%

   VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory withou...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.