Live › vulnerability › CVE-2026-115724
Go to dashboardVLC for Android before 3.7.2 trusts content URIs claiming the K-9 Mail or Gmail attachment authorities, so a co-installed app with no permissions can send VLC a crafted intent. That lets the attacker write chosen content under a chosen name in the shared Download directory, overwriting other apps' files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Android users who have VLC for Android before 3.7.2 installed and granted All files access, with another app on the same device able to send it intents. Devices without VLC, or with VLC on 3.7.2 or later, are not affected. Without All files access the overwrite is limited to what VLC can already write.
No product ranges from the sources yet.
3.7.23.7.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
This page as .md · .json · in your agent: get_signal("CVE-2026-115724")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.