CVE-2026-56711

VLC media player contains an integer overflow (CWE-190) in its picture buffer allocation: in AllocatePicture (src/misc/picture.c) the byte total is accumulated with 32-bit arithmetic, so for very large picture dimensions the product of plane pitch and lines wraps before it is widened to a 64-bit size, and both existing guard checks evaluate only the already-wrapped value. As a result, aligned_alloc reserves a much smaller buffer than the picture actually requires, and a crafted PNG whose IHDR chunk declares very large width and height values - which reaches the code through the image demuxer that only limits the input file's byte count, not the declared dimensions - causes the PNG decoder (modules/codec/png.c) to write past the end of the allocation with attacker-influenced length and content (CWE-787). Opening the malicious PNG file directly or through a playlist entry is sufficient to trigger the flaw under default settings, and per the high CVSS 4.0 score (8.6) the attacker gains high confidentiality, integrity, and availability impact on the player process, i.e., controlled heap corruption that can crash VLC and potentially execute code. All VLC users who open untrusted image files are potentially affected; the available data does not specify affected version ranges. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so no exploitation has been reported to date.

What to do: Until a patched VLC release is available, avoid opening untrusted PNG image files or playlist entries referencing images with VLC, and consider setting a different application as the default PNG handler. No fixed version is specified in the available data, so monitor VideoLAN advisories for an update addressing CVE-2026-56711 and apply it promptly when released.