VLC Media Player CVE-2026-56711

The only prerequisite is that the victim opens a crafted PNG file in VLC 3.0.0-3.0.23 - either directly or via a playlist entry containing the PNG. No non-default settings, no authentication, and no special server-side configuration are required; the image demuxer is active by default and the PNG codec is included in standard builds. What limits exploitation: (1) user interaction - the victim must open the file (UI:P/UI:R); (2) the attacker must calculate IHDR dimensions whose pitch*lines product wraps to a small value usable as an allocation size, requiring offline arithmetic but not environment-specific memory knowledge; (3) successful code execution beyond a crash requires defeating heap mitigations (ASLR, guard allocations) on the target platform. The vulnerability is not reachable via network streaming without user-initiated file open.

Real-world exploitation risk is moderate-low despite the severity of the primitive. The CVSS 4.0 vector (AV:L/AC:H/PR:N/UI:P) reflects that a user must actively open a crafted file, and the AC:H rating acknowledges the need to engineer specific IHDR dimensions that produce a useful wrapped allocation size. EPSS at 0.30% (22nd percentile) corroborates low near-term exploitation likelihood. No active exploitation is recorded in CISA KEV, and no public proof-of-concept has been identified at time of analysis. The impact ceiling is high - heap OOB write with attacker-influenced content and length is a classic RCE primitive on a user-privilege process - but achieving a reliable exploit requires bypassing modern heap mitigations (ASLR, guard pages, heap randomization). The discrepancy between the provided AC:H rating and the deterministic nature of the overflow (attacker fully controls IHDR dimensions) is worth noting: engineering the wrapped size to a small useful value requires calculation but is not probabilistically dependent on environment state, suggesting AC:L may be more accurate. Overall: genuine risk for VLC desktop users who open untrusted media files, but not an immediately automatable mass-exploitation scenario.

An attacker crafts a PNG file whose IHDR declares width and height values chosen so that i_pitch * i_lines overflows 32-bit signed arithmetic to a small positive value (e.g., 4 or 8 bytes), passes the wrapped value through both allocation guards, and triggers a large heap write when libpng decodes the image. The victim receives the file via email, chat, or a web download and opens it directly in VLC or via a playlist - no non-default settings are required. The PNG decoder writes attacker-controlled scanline data well past the end of the tiny allocation, enabling potential code execution in the VLC process context.