PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-115724 VideoLAN CVE debrief

A confused-deputy file overwrite vulnerability exists in VLC for Android before 3.7.2, allowing a co-installed app without permissions to overwrite files in the shared Download directory. This vulnerability can lead to data loss or corruption and increased risk of malicious activity. Defenders should assess exposure and prioritize updating to version 3.7.2 or later. The vulnerability is caused by a confused-deputy issue in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority.

Vendor
VideoLAN
Product
VLC for Android
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-23
Advisory published
2026-10-23
Advisory updated
2026-10-23

Who should care

Defenders responsible for managing VLC for Android installations, particularly those with co-installed apps without permissions, should assess exposure and prioritize updating to version 3.7.2 or later.

Why it matters

Defenders should care about CVE-2026-115724 because it allows a co-installed app without permissions to overwrite files in the shared Download directory, potentially leading to data loss or corruption and increased risk of malicious activity.

  • File overwrite in shared Download directory
  • Potential data loss or corruption
  • Increased risk of malicious activity

Technical summary

The vulnerability exists in FileUtils.getUri() and allows a co-installed app without permissions to declare com.fsck.k9.attachmentprovider or gmail-ls authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory. This can lead to data loss or corruption and increased risk of malicious activity. Defenders should prioritize updating VLC for Android to version 3.7.2 or later and verify that the update has been applied successfully.

Defensive priority

Defenders should prioritize updating VLC for Android to version 3.7.2 or later, and verify that the update has been applied successfully.

Recommended defensive actions

  • Update VLC for Android to version 3.7.2 or later
  • Verify that the update has been applied
  • Monitor for suspicious activity
  • Review compensating controls
  • Check relevant monitoring
  • Track exceptions
  • technicalSummary

Evidence notes

The vulnerability is caused by a confused-deputy issue in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. This allows a co-installed app without permissions to declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory. The issue is limited to VLC for Android before 3.7.2. Defenders should verify that the update has been applied and that

Sources and references

Verified primary and authoritative sources

  • CVE-2026-115724 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-115724

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-115724 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115724

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115724.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/videolan/vlc-android/commit/d289a54689d82eb788ec547ff5fb08f847ae62e6

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/videolan/vlc-android/releases/tag/3.7.2

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/videolan/vlc-android/blob/3.7.1/application/vlc-android/src/org/videolan/vlc/util/FileUtils.kt

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/vlc-for-android-before-3.7.2-file-overwrite-via-spoofed-mail-attachment-provider

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.