CVE-2026-56711

high Red Hat
CVSS v3 Base Score
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Published: September 9, 2026 (1 days ago)
Last Modified: September 9, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in VLC media player. An integer overflow vulnerability exists when computing the size of a picture buffer, specifically in the AllocatePicture function. A remote attacker could exploit this by providing a specially crafted Portable Network Graphics (PNG) image file with large width and height dimensions. This leads to an undersized memory allocation, allowing the decoder to write past the end of the allocated buffer. This heap out-of-bounds write can result in arbitrary code execution.

CWE

CWE-787

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com 🔗 github.com