CVE-2026-115724 VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115724?
CVE-2026-115724 is a low-severity vulnerability in VideoLAN VLC for Android, published on 23 Oct 2026.
Official description
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
Weakness: CWE-346
Which versions are affected by CVE-2026-115724?
How do I fix CVE-2026-115724?
No fix has been published for CVE-2026-115724 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115724 being exploited?
There is no known exploitation of CVE-2026-115724 in the wild and no public exploit code.
Sources
Also known as GHSA-7vgw-xvvg-pq6r.