Skip to content
OpenAdvisories
Medium WID-SEC-2026-0549 2 CVEs

VLC für Android: Mehrere Schwachstellen

Published Feb 26, 2026 · Updated Feb 26, 2026 · de-DE

Platform: Android

Summary

Ein Angreifer kann mehrere Schwachstellen in VLC für Android ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

Product

VLC Media Player ist ein Programm zur Wiedergabe von Multimedia-Dateien und Netzwerkstreams.

Vulnerabilities 2

  • Medium 4.9
    CVE-2026-26228

    VLC for Android < 3.7.0 Remote Access Path Traversal

    VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured down…

    VideoLAN VLC for Android Android
  • Low 3.7
    CVE-2026-26227

    VLC for Android < 3.7.0 Remote Access OTP Authentication Bypass

    VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does no…

    VideoLAN VLC for Android Android

Revision history

  1. #1

    Initiale Fassung

References