CVE-2026-56711 — VideoLAN VLC media player

What is CVE-2026-56711?

VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator. The overflow check that precedes it divides in 64-bit arithmetic and therefore does not constrain the product, and the subsequent comparison against PICTURE_SW_SIZE_MAX examines the already wrapped value, so both guards pass. aligned_alloc then reserves the small wrapped size while the decoder writes scanlines sized from the original dimensions. A crafted PNG whose IHDR declares large width and height reaches this path through the image demuxer, whose only size guard is on the input file's byte count rather than the declared dimensions, and the decoder in modules/codec/png.c writes past the end of the allocation with attacker-influenced length and content. Opening the file directly or through a playlist entry is sufficient, with no non-default settings.

The record classifies CVE-2026-56711 under weakness classes CWE-190, CWE-787. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs a user to take an action first, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 26 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 8.8 — HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0 base score: 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS (FIRST): 0.2% probability of exploitation in the next 30 days, higher than 22.4% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 5.3/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-09-09

Is CVE-2026-56711 being exploited?

No public exploitation evidence for CVE-2026-56711 is recorded in the sources Threadlinqs tracks — CISA KEV, Exploit-DB, public proof-of-concept repositories and ProjectDiscovery Nuclei — as of 2026-09-09. That is an absence of evidence in those feeds, not a guarantee that the vulnerability is unexploited.

Affected products and versions

VideoLAN: VLC media player

How to fix CVE-2026-56711

No vendor patch reference has been recorded for CVE-2026-56711 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-56711

1 tracked threat in the Threadlinqs corpus references CVE-2026-56711, either in the campaign’s CVE list or as an indicator on the campaign record.

VLC Media Player: Integer Overflow in AllocatePicture (CVE-2026-56711) and RTSP Heap Out-of-Bounds Read (CVE-2026-73324) — HIGH · 2026-09-12

Sources

Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on 2026-09-12. This product uses the NVD API but is not endorsed or certified by the NVD.