{"schema":"threatline.record/2","record":{"id":"CVE-2026-115724","aliases":[],"summary":"VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider","details":"VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.","categories":["Unclassified"],"product":"VLC for Android","vendor":"VideoLAN","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115724","source_modified_at":"2026-10-23T11:36:47.719Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"VLC for Android","vendor":"VideoLAN","versions":[{"lessThan":"3.7.2","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115724","source_modified_at":"2026-10-23T11:36:47.719Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"VLC for Android","ecosystem":null},"version":"3.7.2","basis":"first unaffected version stated in the CVE record"}],"cvss":2.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00115,"percentile":0.01471,"score_date":"2026-10-24"},"published_at":"2026-10-23T11:36:47.719Z","modified_at":"2026-10-23T11:36:47.719Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115724","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T11:36:47.719Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115724","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/videolan/vlc-android/commit/d289a54689d82eb788ec547ff5fb08f847ae62e6","tags":["patch"]},{"source":"CVE List","url":"https://github.com/videolan/vlc-android/releases/tag/3.7.2","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/videolan/vlc-android/blob/3.7.1/application/vlc-android/src/org/videolan/vlc/util/FileUtils.kt#L397-L428","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/vlc-for-android-before-3.7.2-file-overwrite-via-spoofed-mail-attachment-provider","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T11:36:47.719Z","content_hash":"db82dec158b0b88deb9c4b0b5ec38305e651e18e87091b2469f5067fa66ee118"}}