CVE-2026-56711: VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.
Affected Software
Event History
Frequently Asked Questions
Are default VLC installations affected?
Yes. The issue can be reached with no non-default settings when VLC opens a crafted PNG directly or through a playlist entry.
What does an attacker need to do to trigger the flaw?
An attacker needs to provide a crafted PNG with large width and height values in its IHDR header and convince a user to open it, either directly or through a playlist entry. No prior privileges are required.
Which installations should be considered affected?
VLC media player versions 3.0.0 through 3.0.23 are identified as affected. The vulnerable path is used by the image demuxer and PNG decoder.
What can be done before an update is available?
Avoid opening PNG files from untrusted sources in VLC, including PNG files referenced by playlists. The stated trigger depends on VLC processing attacker-controlled PNG dimensions.