TL;DR Two VLC media player vulnerabilities let attackers corrupt or read heap memory. One triggers on a crafted PNG file. The other triggers when VLC connects to a malicious RTSP server. No patch is available yet. Why these VLC media player vulnerabilities matter VLC ships on hundreds of millions of desktops worldwide. A single booby-trapped file could reach that huge install base.