VLC for Android versions prior to 3.7.2 contain a confusion-deputy flaw in FileUtils.getUri() that blindly trusts content URIs whose authority matches either 'com.fsck.k9.attachmentprovider' or 'gmail-ls'. When a co‑installed application without any permissions registers one of these authorities it can send a crafted VIEW intent to VLC’s exported StartActivity. VLC, if it holds the All files access permission, will write the supplied content URI to the shared Download directory using the attacker‑chosen file name, thereby overwriting files belonging to other applications.

VideoLAN VLC for Android 3.7.1 and earlier versions are affected. The vulnerability is fixed in version 3.7.2 and later.

The CVSS score of 2.1 indicates low severity. No EPSS score is available and the vulnerability is not listed in CISA KEV. Exploitation requires a locally installed adversarial app that can register the targeted authorities and construct an intent to the exported StartActivity. VLC must have All files access permission for the attack to succeed. The damage scope is the shared Download directory, which could permanently replace or corrupt files of other apps.