Integer Overflow Vulnerability in VLC Media Player by VideoLAN

CVE-2026-56711

What is CVE-2026-56711?

A vulnerability exists in VLC Media Player where a 32-bit arithmetic overflow can occur during picture buffer allocation. This is due to improper handling of pixel sizes when computing the buffer allocation values. Specifically, the picture buffer size is accumulated in a manner that allows for an overflow, leading to a heap out-of-bounds write when processing specially crafted PNG files. The decoder reads beyond the allocated memory bounds, potentially allowing an attacker to inject malicious content. This issue is triggered by declaring large image dimensions that exceed the expected buffer size, compromising the security of the application without any intricate settings required to exploit it.

References