CVE-2026-56711: VLC Media Player Buffer Overflow Vulnerability

CVE-2026-56711 is a buffer overflow vulnerability in VLC media player caused by integer overflow in picture buffer allocation. Attackers can exploit this through crafted PNG files to write past buffer boundaries. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-56711 Overview

CVE-2026-56711 is a heap out-of-bounds write in VLC media player caused by an integer overflow [CWE-190] in the picture buffer allocator. The AllocatePicture function in src/misc/picture.c computes a picture buffer size using 32-bit arithmetic and allocates memory from the wrapped result. A crafted PNG file with large declared dimensions triggers the overflow through the image demuxer and PNG codec in modules/codec/png.c. Opening the file directly or via a playlist entry is sufficient to trigger the flaw, with no non-default settings required. VulnCheck's advisory identifies affected versions as VLC 3.0.0 through 3.0.23.

Critical Impact
Attackers can trigger a heap out-of-bounds write by convincing a user to open a crafted PNG file in VLC, enabling potential arbitrary code execution in the media player process.

Affected Products

VLC media player 3.0.0 through 3.0.23
VLC image demuxer (modules/demux/image.c)
VLC PNG codec (modules/codec/png.c)

Discovery Timeline

2026-09-09 - CVE-2026-56711 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-56711

Vulnerability Analysis

The vulnerability resides in the picture buffer allocation path used by VLC when decoding image formats. AllocatePicture in src/misc/picture.c accumulates the required buffer size across image planes using the expression i_bytes += p->i_pitch * p->i_lines. Both i_pitch and i_lines are declared as int in include/vlc_picture.h, so the multiplication is evaluated in 32-bit signed arithmetic before being widened to the size_t accumulator. Sufficiently large plane dimensions wrap the product before assignment.

The preceding overflow check performs its computation in 64-bit arithmetic and therefore does not constrain the 32-bit multiplication. The subsequent comparison against PICTURE_SW_SIZE_MAX inspects the already wrapped value, so both guards pass. aligned_alloc then reserves a small buffer while the decoder writes scanlines sized from the original, unwrapped dimensions.

Root Cause

The root cause is inconsistent integer width between the guard logic and the arithmetic that produces the allocation size. The guard divides in 64-bit space, but the productive multiplication is truncated to 32 bits. This mismatch permits an attacker-controlled product to wrap silently while both sanity checks continue to succeed.

Attack Vector

A crafted PNG whose IHDR chunk declares large width and height values reaches the vulnerable allocation through the image demuxer. The demuxer's only size guard measures the input file's byte count rather than the declared image dimensions, so a compact file can specify very large geometries. The PNG codec in modules/codec/png.c then writes scanlines whose length and content are influenced by the attacker, past the end of the undersized heap allocation. See the VulnCheck Advisory on VLC Vulnerability for the full technical write-up.

Detection Methods for CVE-2026-56711

Indicators of Compromise

PNG files with IHDR-declared width and height values that are disproportionately large relative to the file's on-disk size.
Unexpected VLC process crashes with heap corruption signatures shortly after opening image files or playlists referencing images.
Playlists (.m3u, .xspf) that reference remote or local PNG assets from untrusted sources.

Detection Strategies

Inspect PNG assets at the network or mail gateway for IHDR dimensions inconsistent with the file's compressed data length.
Monitor endpoints for vlc.exe or vlc process termination with access violation or heap corruption exit codes.
Correlate media file opens with subsequent child process creation from the VLC process tree, which is anomalous for image playback.

Monitoring Recommendations

Enable EDR telemetry on media player processes to capture memory access violations and unexpected module loads.
Log inbound file transfers of PNG files from untrusted email, chat, and web sources for retrospective analysis.
Track VLC version deployment across the estate to identify hosts still running versions in the 3.0.0 through 3.0.23 range.

How to Mitigate CVE-2026-56711

Immediate Actions Required

Inventory all endpoints running VLC media player and identify installations in the 3.0.0 through 3.0.23 range.
Restrict opening of PNG files and playlists from untrusted sources in VLC until patched builds are deployed.
Remove file association between PNG and VLC on endpoints where VLC is not required for image playback.

Patch Information

At the time of publication, no fixed version identifier was recorded in the NVD entry. Consult the VLC Media Player Repository and the VulnCheck Advisory on VLC Vulnerability for the latest patched release and upgrade guidance. Track upstream commits to src/misc/picture.c, modules/codec/png.c, and modules/demux/image.c for the corrective changes.

Workarounds

Avoid opening PNG files or playlists containing image entries from untrusted sources with VLC.
Use a dedicated image viewer for PNG rendering instead of VLC until an updated build is installed.
Deploy application control policies that block execution of vulnerable VLC versions on managed endpoints.