Loading vulnerability…
Integer Overflow and Heap Buffer Overflow in VLC Picture Allocation
CVE-2026-56711 is an integer-overflow vulnerability in the AllocatePicture function of VLC media player versions 3.0.0 through 3.0.23. Picture-buffer sizing multiplies the signed 32-bit i_pitch and i_lines values before promoting the result to a size_t accumulator. Oversized image dimensions can cause this multiplication to overflow, and subsequent allocation checks can accept the already-wrapped value. A crafted PNG with oversized IHDR dimensions can therefore cause an undersized heap allocation, followed by out-of-bounds writes when the PNG decoder processes scanlines using the original dimensions. Opening the image directly or through a referencing playlist can cause application termination or potentially arbitrary code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt VLC heap memory and terminate the application, causing denial of service. Depending on memory layout and platform exploit mitigations, the out-of-bounds write may permit arbitrary code execution with the privileges of the VLC process, potentially compromising data and resources accessible to that process. Elevated privileges are not inherently obtained.
If you can’t patch tonight, do this now.
Until patched, avoid opening untrusted or unsolicited PNG images and playlists that reference them. Apply file-content controls to untrusted media and restrict VLC use in high-risk workflows. Run VLC with minimal privileges and sandbox or otherwise isolate it to limit the consequences of potential code execution. Validate media sources used by automated playback systems.
Patch, then assume compromise.
Upgrade to VLC 3.0.24 or a later vendor-provided fixed release, or install the applicable distribution security update. Fixed packages include VLC 3.0.24-0+deb12u1 for Debian 12, 3.0.24-0+deb13u1 for Debian 13, and 3.0.24-1.fc43 for Fedora 43. openSUSE 16 addresses the vulnerability through advisory openSUSE-SU-2026:22198-1, which updates VLC to 3.0.24. Update affected VLC libraries and plugins alongside the player. The allocation fix uses overflow helpers to prevent unsafe picture-buffer size calculations.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.