CVE-2026-115724— VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
Quick assessment
Affected
VideoLAN VLC for Android
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
3.7.2 版本之前的 Android 版 VLC 在 中存在一个“混淆代理”（confused-deputy）文件覆盖漏洞。该漏洞源于 VLC 仅根据 或 这两个权限标识（authority）来信任内容 URI（content URI）。任何与之共存的、无需额外权限的应用均可声明上述权限标识，并向已导出的 发送精心构造的 VIEW 意图（intent）。若 VLC 拥有“所有文件访问”权限，攻击者即可借此让 VLC 在共享的 Download 目录下，以攻击者指定的文件名写入其控制的内容，从而覆盖其他应用的文件。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| VideoLAN | VLC for Android | < 3.7.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115724
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
Source: CVE Program / CVE List V5
Vulnerability Description
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| VideoLAN | VLC for Android | 0 ~ 3.7.2 | - |
|
II. Public POCs for CVE-2026-115724
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115724
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-115724 (1)
Vendor Advisories for CVE-2026-115724 (1)
Proof of Concept for CVE-2026-115724 (1)
Vendor Pages for CVE-2026-115724 (1)
-
🔗 Release 3.7.2 · videolan/vlc-android · GitHub release-notes
IV. Related Vulnerabilities
Same vendor: VideoLAN
-
CVE-2026-112283
libbluray through 1.5.1 Uncontrolled Memory Allocation via _ -
CVE-2026-112282
VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi -
CVE-2026-112058
libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpT -
CVE-2026-112057
libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe -
CVE-2026-102875
VLC media player before 3.0.24 Path Traversal via skins2
Same weakness: CWE-346
-
CVE-2026-83813
Twisted: DNS Response Spoofing in twisted.names Due to Missi -
CVE-2026-58497
Uni-CLI: Legacy HTTP MCP transport accepted browser-originat -
CVE-2026-112085
webpack-dev-server vulnerable to cross-origin WebSocket acce -
CVE-2026-114121
Electron: openExternal permission requests can be attributed -
CVE-2026-113800
Electron: HID and USB permission checks can be attributed to
V. Comments for CVE-2026-115724
No comments yet