CVE-2026-56711: 
VLC media player vulnerability analysis and mitigation

CVE-2026-56711 is a heap buffer overflow vulnerability in VLC media player caused by an integer overflow in picture buffer size calculation when processing crafted PNG files. It affects VLC media player versions 3.0.0 through 3.0.23, developed by VideoLAN. The vulnerability was published on September 9, 2026, and a patch is available. It carries a CVSS v3.1 base score of 7.0 (High) and a CVSS v4.0 base score of 7.3 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is an integer overflow (CWE-190) leading to an out-of-bounds write (CWE-787) in the AllocatePicture function within src/misc/picture.c. The buffer size is accumulated as i_bytes += p->i_pitch * p->i_lines, where both i_pitch and i_lines are declared as int in include/vlc_picture.h, causing the multiplication to be evaluated at 32-bit precision and wrap before being widened to a size_t accumulator. The overflow check preceding this operation uses 64-bit division and therefore does not constrain the 32-bit product, and the subsequent comparison against PICTURE_SW_SIZE_MAX examines the already-wrapped value — so both guards pass. aligned_alloc then reserves only the small wrapped buffer size, while the PNG decoder in modules/codec/png.c writes scanlines based on the original declared dimensions, resulting in a heap out-of-bounds write with attacker-influenced length and content. The image demuxer in modules/demux/image.c only guards on the input file's byte count, not the declared IHDR dimensions, allowing a crafted PNG with large width/height values to reach this code path (VulnCheck Advisory, VLC source - picture.c, VLC source - png.c).

Successful exploitation can result in arbitrary code execution with the privileges of the VLC process, or application termination (crash). An attacker who tricks a user into opening a crafted PNG file — either directly or via a playlist entry — can write arbitrary data past the end of a heap-allocated buffer, potentially achieving full control of the affected process. This exposes confidentiality, integrity, and availability of the user's system at the process privilege level, with potential for further lateral movement if VLC is run with elevated privileges (Red Hat Advisory, GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation (Red Hat Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable, reflecting the requirement for user interaction. The EPSS score is approximately 0.299%, indicating a low near-term exploitation probability. No threat actor attribution has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a user to open a malicious PNG file, which can be delivered directly or embedded in a playlist entry — no non-default settings are required (GitHub Advisory).

1. Craft a malicious PNG file: Create a PNG file with an IHDR chunk declaring large width and height values (e.g., dimensions that cause i_pitch * i_lines to overflow a 32-bit integer when multiplied, resulting in a small wrapped value). The actual compressed image data can be minimal, as the demuxer's size guard checks only the file's byte count.
2. Deliver the payload: Distribute the crafted PNG to the target user via email attachment, web download, shared network drive, or embed it as an entry in a VLC playlist (.m3u, .xspf, etc.).
3. Trigger user interaction: Convince the target to open the malicious PNG or playlist in VLC media player (versions 3.0.0–3.0.23). No special settings or elevated privileges are required.
4. Integer overflow triggers undersized allocation: VLC's image demuxer passes the file to the PNG decoder; AllocatePicture computes the buffer size using 32-bit arithmetic, overflows, and calls aligned_alloc with the small wrapped size.
5. Heap out-of-bounds write: The PNG decoder (modules/codec/png.c) writes scanlines using the original large dimensions into the undersized buffer, writing attacker-influenced data past the end of the heap allocation.
6. Achieve code execution or crash: Depending on heap layout and exploit refinement, the out-of-bounds write can corrupt adjacent heap metadata or function pointers, potentially enabling arbitrary code execution at VLC process privilege level, or causing a crash (VulnCheck Advisory, VLC source - png.c).

• File System: Presence of unexpected PNG files with anomalously small file sizes but large declared IHDR dimensions in user download directories, temp folders, or playlist directories; unexpected files written to disk by the VLC process after opening a PNG.
• Process: VLC process (vlc, vlc.exe) crashing with a segmentation fault or access violation shortly after opening a PNG file or playlist; unexpected child processes spawned by VLC (e.g., shells, network utilities).
• Logs: Application crash reports or core dumps referencing AllocatePicture in src/misc/picture.c or the PNG decoder in modules/codec/png.c; heap corruption error messages in VLC logs.
• Network: Outbound network connections from the VLC process to unexpected external IP addresses following the opening of a PNG file, which may indicate post-exploitation activity.

VideoLAN has released a patch addressing this vulnerability; users should update VLC media player to a version beyond 3.0.23 as soon as it becomes available. Until patching is possible, users should avoid opening PNG files or playlists containing PNG entries from untrusted or unknown sources in VLC. Organizations can consider restricting VLC's ability to open files from untrusted network locations or enforcing application allowlisting to limit exposure (Red Hat Advisory, GitHub Advisory).

The vulnerability received coverage from multiple security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and CyberPress, with articles highlighting the risk to VLC's large user base from malicious image files and media links (GBHackers, CyberSecurityNews). Social media discussion appeared on Mastodon and X (via DarkWebInformer and DailyCyberSecurity accounts), amplifying awareness of the flaw. The Hacker News weekly recap also referenced the vulnerability in the context of notable September 2026 security disclosures (The Hacker News). Community sentiment generally emphasized the importance of updating VLC promptly given its widespread installation base.