TI-2026-79728 Aliases CVE-2026-115724 GHSA-7vgw-xvvg-pq6r

File overwrite in VLC for Android via spoofed mail attachment provider

LOW 10CWE-346Published 2026-10-23 · Updated 2026-11-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

VLC for Android before 3.7.2 contains an origin validation error in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory. The write can overwrite other apps' files when VLC holds All files access.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00089 0th percentileScored 2026-11-07

Fix Fixed VLC for Android (VideoLAN): 3.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VideoLAN	VLC for Android	before 3.7.2	3.7.2	Patch available	CNA

VLC for Android VendorVideoLAN Affected before 3.7.2 Fixed in 3.7.2 Patch available CNA

Remediation

Update VLC for Android to version 3.7.2 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA VLC for Android (VideoLAN) Fixed in 3.7.2

Timeline

2026-10-23 Threatist record created from CVE-2026-115724
2026-10-23 Alias added: GHSA-7vgw-xvvg-pq6r
2026-11-04 CISA SSVC decision points changed

References

Patch 1

https://github.com/videolan/vlc-android/commit/d289a54689d82eb788ec547ff5fb08f847ae62e6

Other 2

TI-2010-03131 libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers… CVSS 2.0HIGH 9.3
TI-2023-25623 Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a… CVSS 3.1CRITICAL 9.8
TI-2008-04437 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… CVSS 2.0HIGH 9.3
TI-2023-25624 Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. CVSS 3.1HIGH 7.5
TI-2022-19821 An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4… CVSS 3.1HIGH 7.8
TI-2012-01563 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… CVSS 2.0HIGH 9.3

See all 137 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences