The vulnerability of buildings to the impact of rockfalls is a topic that has recently attracted increasing attention in the scientific literature. The quantification of the vulnerability, when based on empirical or heuristic approaches requires data recorded from historical rockfalls, which are not always available. This is the reason why appropriate alternatives are required. The use of analytical and numerical models can be one of them. In this paper, a methodology is proposed for the analytical evaluation of the vulnerability of reinforced concrete buildings. The vulnerability is included in the risk equation by incorporating the uncertainty of the impact location of the rock block and the subsequent damage level. The output is a weighted vulnerability that ranges from 0 to 1 and expresses the potential damage that a rock block causes to a building in function of its velocity and size. The vulnerability is calculated by the sum of the products of the probability of block impact on each element of the building and its associated damage state, the latter expressed in relative recovery cost terms. The probability of exceeding a specific damage state such as non-structural, local, partial, extensive or total collapse is also important for the quantification of risk and to this purpose, several sets of fragility curves for various rock diameters and increasing velocities have been prepared. An example is shown for the case of a simple reinforced concrete building and impact energies from 0 to 4075 kJ.