Heap-based Buffer Overflow in VLC Media Player via Malformed PNG

VLC media player is affected by a heap-based buffer overflow vulnerability (CVE-2026-56711) originating in the AllocatePicture function within src/misc/picture.c. The vulnerability occurs because the application uses 32-bit arithmetic to calculate the size of picture buffers by multiplying i_pitch and i_lines. Because these fields are declared as int, the multiplication wraps before being cast to a 64-bit accumulator. Existing overflow guards use 64-bit division, which fails to constrain the product, and subsequent validation against PICTURE_SW_SIZE_MAX checks the already wrapped value. Consequently, aligned_alloc reserves an insufficient amount of memory.

When the PNG decoder (modules/codec/png.c) processes a crafted file with large dimensions, it writes scanlines based on the original dimensions into the undersized buffer. This flaw is triggered simply by opening a malicious PNG file or a playlist entry containing a reference to one, without requiring non-default settings. Successful exploitation leads to arbitrary memory corruption, potentially allowing for remote code execution.

Impact

Successful exploitation of this vulnerability allows an attacker to write past the end of an allocated buffer with attacker-influenced data, leading to memory corruption. This poses a high risk to users who open media files from untrusted sources, as the attack requires no user interaction beyond opening the file. The vulnerability affects all versions of VLC media player currently using the vulnerable AllocatePicture implementation.

Recommendation

• Monitor for updates from VideoLAN and patch VLC media player to the version containing the fix for CVE-2026-56711 as soon as it is released.
• Implement endpoint controls to restrict users from opening media files from untrusted network locations or unverified external drives.
• Utilize application control policies to restrict the execution of VLC in high-risk, internet-facing environments if regular patching is not feasible.