Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-56711— VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation

Quick assessment

Affected
VideoLAN VLC media player
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VLC 媒体播放器使用 32 位算术来计算图像缓冲区的大小，并根据其回绕（wrap-around）结果进行内存分配。在 中的 函数里，累计字节数通过 累加，而 结构体中的 和 字段在 中均被声明为 类型。因此，乘法运算在 32 位下求值并发生整数溢出（回绕），之后才被扩展为 累加器。 位于其前面的溢出检查使用 64 位算术进行除法，因此无法约束该乘积；而随后与 的比较检查的是已经回绕的值，导致这两道防护措施均被绕过。 随后仅保留了较小的回绕后的大小，而解码器却按照原始维度写入扫描线。 一个精心构造的 PNG 文件，

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-56711

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation
Source: CVE Program / CVE List V5
Vulnerability Description
VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator. The overflow check that precedes it divides in 64-bit arithmetic and therefore does not constrain the product, and the subsequent comparison against PICTURE_SW_SIZE_MAX examines the already wrapped value, so both guards pass. aligned_alloc then reserves the small wrapped size while the decoder writes scanlines sized from the original dimensions. A crafted PNG whose IHDR declares large width and height reaches this path through the image demuxer, whose only size guard is on the input file's byte count rather than the declared dimensions, and the decoder in modules/codec/png.c writes past the end of the allocation with attacker-influenced length and content. Opening the file directly or through a playlist entry is sufficient, with no non-default settings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
VideoLAN VLC media player 3.0.0 ~ 3.0.23 -

II. Public POCs for CVE-2026-56711

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-56711

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-56711 (4)

Vendor Advisories for CVE-2026-56711 (1)

Proof of Concept for CVE-2026-56711 (1)

IV. Related Vulnerabilities

Same product: VLC media player
Same vendor: VideoLAN
Same weakness: CWE-190

V. Comments for CVE-2026-56711

No comments yet

Leave a comment