CVE-2026-56711

VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability

7.3 HighFix available

VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.12%Down 0.2 points since Sep 10, 2026

What each source reports

CVE List Score used 7.3

VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability

Record: CVE-2026-56711
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190, CWE-787
Updated: 2026-11-02

EUVDEUVD-2026-74906 7.3

Record: EUVD-2026-74906
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-35jx-w2j3-h2m2 8.6

VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from...

VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator. The overflow check that precedes it divides in 64-bit arithmetic and therefore does not constrain the product, and the subsequent comparison against PICTURE_SW_SIZE_MAX examines the already wrapped value, so both guards pass. aligned_alloc then reserves the small wrapped size while the decoder writes scanlines sized from the original dimensions. A crafted PNG whose IHDR declares large width and height reaches this path through the image demuxer, whose only size guard is on the input file's byte count rather than the declared dimensions, and the decoder in modules/codec/png.c writes past the end of the allocation with attacker-influenced length and content. Opening the file directly or through a playlist entry is sufficient, with no non-default settings.

Record: GHSA-35jx-w2j3-h2m2
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

NVD 7.3

Record: CVE-2026-56711
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190, CWE-787
Updated: 2026-11-02

OSV 7.3

VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability

Record: CVE-2026-56711
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-190, CWE-787
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-56711 7.3

Record: DEBIAN-CVE-2026-56711
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2026-56711 7.3

Record: UBUNTU-CVE-2026-56711
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2026-0494 No score

Updated vlc package fixes security vulnerabilities

VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability. (CVE-2026-56711) VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability. (CVE-2026-73324)

Record: MGASA-2026-0494
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11910-1 No score

libvlc5-3.0.24-1.1 on GA media

These are all security issues fixed in the libvlc5-3.0.24-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11910-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:22198-1 No score

Security update for vlc

This update for vlc fixes the following issues:

Changes in vlc:

Add conditional for pkgconfig(vpl) BuildRequires and plugin, exclude %{arm} ppc64le %{ppc} s390x.
Add conditional for pkgconfig(libnfs) BuildRequires and plugin, exclude %{arm}
Switch to qt6:
- Drop libQt5Gui-private-headers-devel, pkgconfig(Qt5Core), pkgconfig(Qt5Gui), pkgconfig(Qt5Svg), pkgconfig(Qt5Widgets) and pkgconfig(Qt5X11Extras). Further: disable pkgconfig(libprojectM) and drop outright conditional pkgconfig(libprojectM-qt5).
- Add qt6-base-private-devel, qt6-gui-private-devel, pkgconfig(Qt6Core), pkgconfig(Qt6Gui), pkgconfig(Qt6Svg) and pkgconfig(Qt6Widgets).
Add pkgconfig(vpl) BuildRequires: Build qsv plugin.
Require vlc from vlc-devel: whereas the desktop app is not exactly needed when building against the libraries, many consumers expect the full stack to be present.
Drop schroedinger-devel BuildRequires: Not needed, nor used. Upstream removed support in 3.0.24
Rework subpackaging
- Split the desktop output plugins out of the main vlc package, for use on headless systems
- Installing vlc-noX and vlc-plugins-desktop will now give a fully functional CLI installation, without pulling in the graphical frontend
- Main 'vlc' package will now pull in all components for desktop GUI interface
Update to version 3.0.24:
- Codecs:
  - Use FFmpeg 8.1 (upgraded from 4.4)
  - Support APV decoder (FFmpeg 8)
  - Support Atrac3/Atrac9 decoding
  - Remove schroedinger support for dirac in favor of avcodec
  - Fix Speex leaks and packetization issues
  - Fix WebVTT CSS parsing and error handling
  - Fix FLAC and HEVC packetizer edge cases
  - Fix AudioToolbox MIDI synthesizer crash on macOS 26+
- Demuxers:
  - Add support for CEA-708 closed captions in MP4
  - Expose ID3v2 metadata in MPEG demuxer
  - Improve subtitle language detection from filenames and SSA/ASS metadata
  - Fix several MKV crashes, leaks, hangs and malformed file handling issues
  - Fix AVI hang with zero-sized strd chunks
  - Fix MP4, MPEG-TS, Ogg, RealAudio and subtitle demuxing edge cases
- Access:
  - Switch RIST input and output to librist, with main and simple profile support
  - Add SRT listener mode support
  - Add SFTP public key authentication options and ED25519 hostkey support
  - Update SMB2 share enumeration
  - Don't ship RealRTSP plugin (build disabled for all configurations)
- Service Discovery:
  - Include Chromecast model in mDNS renderer names
  - Fix IPv6 addresses in Bonjour service URLs
- Video Output:
  - Fix Direct3D11 adjust filter and texture leaks
  - Fix MediaCodec crop validation
  - Super Resolution scaling with Moore Threads GPUs
- Interface:
  - Qt: Fix default open dialog location
  - Qt: Fix effects window geometry saving
  - Qt: Improve hotkeys dialog strings
- Stream Output:
  - Disable HEVC for original Chromecast devices
- Security:
  - Switch to a new RSA-4096 key for update verification
  - Fix multiple OOB, integer overflow, double-free and use-after-free issues
  - See https://www.videolan.org/security/
  - CVE-2026-56711: picture: inline AllocatePicture() and use overflow helpers (boo#1279900)
- Misc:
  - Add Flatpak build support
  - Fix Audio EQ filter High Frequency parameter
  - Fix artwork preparser crash when artwork title is null
  - Fix LibVLC media list player race
  - Remove NPAPI browser plugin
- Lua:
  - Remove broken youtube.lua plugin
Fix Requires for ffmpeg library

Record: openSUSE-SU-2026:22198-1
Updated: 2026-11-02

Affected products

videolan vlc media player

Affected packages

Affected packages
Package	Affected	Fixed
`vlc` Debian:12	before 3.0.24-0+deb12u1, plus listed versions 3.0.18-23.0.18-33.0.18-43.0.19-13.0.20-0+deb12u1 Show 28 moreShow less 3.0.20-13.0.20-23.0.20-33.0.20-43.0.21-0+deb12u13.0.21-13.0.21-103.0.21-113.0.21-23.0.21-33.0.21-43.0.21-4~exp13.0.21-53.0.21-63.0.21-73.0.21-83.0.21-93.0.22-0+deb12u13.0.22-13.0.22-23.0.22-33.0.22-43.0.22~rc1-13.0.22~rc2-13.0.23-0+deb12u13.0.23-13.0.23-23.0.23-3	3.0.24-0+deb12u1
`vlc` Debian:13	before 3.0.24-0+deb13u1, plus listed versions 3.0.21-103.0.21-113.0.22-0+deb13u13.0.22-13.0.22-2 Show 8 moreShow less 3.0.22-33.0.22-43.0.22~rc1-13.0.22~rc2-13.0.23-0+deb13u13.0.23-13.0.23-23.0.23-3	3.0.24-0+deb13u1
`vlc` Debian:14	before 3.0.24-1, plus listed versions 3.0.21-103.0.21-113.0.22-13.0.22-23.0.22-3 Show 6 moreShow less 3.0.22-43.0.22~rc1-13.0.22~rc2-13.0.23-13.0.23-23.0.23-3	3.0.24-1
`vlc` Mageia:10	before 3.0.24-1.mga10	3.0.24-1.mga10
`vlc` Mageia:10	before 3.0.24-1.mga10.tainted	3.0.24-1.mga10.tainted
`vlc` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 11 moreShow less 2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm12.2.2-5ubuntu0.16.04.5+esm22.2.2-5ubuntu0.16.04.5+esm32.2.2-5ubuntu0.16.04.5+esm4	None known
`vlc` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4 Show 23 moreShow less 2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.23.0.7.1-0ubuntu18.04.13.0.8-0ubuntu18.04.13.0.8-0ubuntu18.04.1+esm13.0.8-0ubuntu18.04.1+esm23.0.8-0ubuntu18.04.1+esm3	None known
`vlc` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 3.0.8-23.0.8-2build13.0.8-33.0.8-3build13.0.8-3build2 Show 6 moreShow less 3.0.8-3build43.0.8-43.0.9.2-13.0.9.2-1ubuntu0.1~esm13.0.9.2-1ubuntu0.1~esm23.0.9.2-1ubuntu0.1~esm3	None known
`vlc` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 3.0.16-13.0.16-1build13.0.16-1build23.0.16-1build33.0.16-1build4 Show 5 moreShow less 3.0.16-1build53.0.16-1build73.0.16-1ubuntu0.1~esm13.0.16-1ubuntu0.1~esm23.0.16-1ubuntu0.1~esm3	None known
`vlc` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 3.0.18-43.0.19-13.0.19-1build13.0.20-1build13.0.20-3build63.0.20-3ubuntu0.1~esm1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`vlc` Ubuntu:26.10	All versions, plus listed versions 3.0.23-13.0.23-33.0.23-3build13.0.24-13.0.24-1ubuntu1	None known
`vlc` Ubuntu:26.04:LTS	All versions, plus listed versions 3.0.21-113.0.22~rc1-13.0.22~rc1-1build13.0.22~rc1-1build23.0.22~rc1-1build3 Show 6 moreShow less 3.0.22~rc2-13.0.22-13.0.22-23.0.22-2build13.0.22-43.0.23-1	None known
`vlc` openSUSE:Tumbleweed	before 3.0.24-1.1	3.0.24-1.1
`vlc` openSUSE:Leap 16.0	before 3.0.24-bp160.1.1	3.0.24-bp160.1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56711 is a high vulnerability (CVSS 7.3) in Videolan Vlc Media Player, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in vlc 3.0.24-0+deb12u1.

References

Show 10 moreShow less