{"id":"CVE-2026-115724","kind":"vulnerability","aliases":["CVE-2026-115724"],"related":[],"title":"VLC for Android: crafted intent overwrites files in Download folder","description":"VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.","summary":"VLC for Android before 3.7.2 trusts content URIs claiming the K-9 Mail or Gmail attachment authorities, so a co-installed app with no permissions can send VLC a crafted intent. That lets the attacker write chosen content under a chosen name in the shared Download directory, overwriting other apps' files.","severity":"low","cvss":2.9,"epss":0.00115,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","package","vlc"],"not_affected_if":["no-all-files-access","vlc-3.7.2-or-later"],"how_to_check":"- Check the installed VLC for Android version in Settings > Apps > VLC; affected if below `3.7.2`\n- Review which apps hold All files access on the device, since the overwrite needs VLC to have that permission","fix":"- Update VLC for Android to `3.7.2` or later\n- Revoke All files access from VLC if it is not needed","status":"open","published_at":"2026-10-23T12:18:13+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:47:54+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:47:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update VLC for Android to `3.7.2` or later\n- Revoke All files access from VLC if it is not needed","reach":"local","title":"VLC for Android: crafted intent overwrites files in Download folder","impact":"medium","summary":"VLC for Android before 3.7.2 trusts content URIs claiming the K-9 Mail or Gmail attachment authorities, so a co-installed app with no permissions can send VLC a crafted intent. That lets the attacker write chosen content under a chosen name in the shared Download directory, overwriting other apps' files.","category":"package","nicknames":[],"who_cares":["android","vlc"],"confidence":0.6,"needs_auth":"no","worst_case":"other apps' files in Download overwritten with attacker content","analyst_note":"","how_to_check":"- Check the installed VLC for Android version in Settings > Apps > VLC; affected if below `3.7.2`\n- Review which apps hold All files access on the device, since the overwrite needs VLC to have that permission","needs_analyst":false,"not_affected_if":["vlc-3.7.2-or-later","no-all-files-access"],"who_is_affected":"Android users who have VLC for Android before 3.7.2 installed and granted All files access, with another app on the same device able to send it intents. Devices without VLC, or with VLC on 3.7.2 or later, are not affected. Without All files access the overwrite is limited to what VLC can already write.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000604,"input_tokens":3397,"output_tokens":529,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115724':13A,16A '-2026':12A,15A '-9':31B '3.7.2':24B,76C 'access':149C 'android':3A,17B,22B,74C 'app':42B,70B,105C,142C 'attach':35B 'attack':55B,126C,132C 'attacker-chosen':125C,131C 'author':36B,100C,111C 'base':91C 'chosen':57B,61B,127C,133C 'claim':28B 'co':40B,103C 'co-instal':39B,102C 'com.fsck.k9.attachmentprovider':95C 'confus':80C 'confused-deputi':79C 'contain':77C 'content':26B,58B,89C,128C 'craft':4A,50B,115C 'cve':11A,14A 'declar':109C 'deputi':81C 'directori':67B,139C 'download':9A,66B,138C 'export':120C 'file':7A,71B,82C,143C,148C 'fileutils.geturi':86C 'folder':10A 'gmail':34B,98C 'gmail-l':97C 'hold':146C 'instal':41B,104C 'intent':5A,51B,117C 'k':30B 'let':53B 'ls':99C 'mail':32B 'make':122C 'name':62B,134C 'overwrit':6A,68B,83C,140C 'packag':18B 'permiss':45B,107C 'send':47B,113C 'share':65B,137C 'startact':121C 'trust':25B,88C 'uri':27B,90C 'view':116C 'vlc':1A,19B,20B,48B,72C,123C,145C 'vulner':84C 'without':106C 'write':56B,124C","nicknames":[],"mitigations":[],"who_affected":"Android users who have VLC for Android before 3.7.2 installed and granted All files access, with another app on the same device able to send it intents. Devices without VLC, or with VLC on 3.7.2 or later, are not affected. Without All files access the overwrite is limited to what VLC can already write.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115724","severity":null,"published_at":"2026-10-23T12:18:13+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115724","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115724","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}