CVE-2026-115724
Low · 2.9CVSS
2.9
EPSS
0.1%
Published
Oct 23, 2026
CISA due date
—
The record
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119331 Ladybird is a truly independent web browser. CWE-346
- CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request… CWE-346
- CVE-2026-119416 CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the… CWE-346
- CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-346
- CVE-2026-61546 AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to… CWE-346
- CVE-2026-118657 Echo is a Go web framework. CWE-346
- CVE-2026-118651 Echo is a Go web framework. CWE-346
- CVE-2026-115413 Missing token audience validation in the OAuth authentication mode of AWS API MCP Server… CWE-346