Description

VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator. The overflow check that precedes it divides in 64-bit arithmetic and therefore does not constrain the product, and the subsequent comparison against PICTURE_SW_SIZE_MAX examines the already wrapped value, so both guards pass. aligned_alloc then reserves the small wrapped size while the decoder writes scanlines sized from the original dimensions. A crafted PNG whose IHDR declares large width and height reaches this path through the image demuxer, whose only size guard is on the input file's byte count rather than the declared dimensions, and the decoder in modules/codec/png.c writes past the end of the allocation with attacker-influenced length and content. Opening the file directly or through a playlist entry is sufficient, with no non-default settings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-09T14:17:12.717Z",
  "pubdate": "2026-09-09T14:17:12.717Z",
  "executiveSummary": "This vulnerability involves an integer overflow in VLC media player during picture buffer allocation, resulting in heap-based buffer overflows.\nThe flaw originates from 32-bit arithmetic performed on image dimension calculations, which allows for a wraparound that bypasses size validation checks.\nThe impact is significant, as an attacker-controlled PNG image can trigger an out-of-bounds write via the decoder, potentially leading to arbitrary code execution or application crashes.\nThe vulnerability affects systems running VLC media player and requires no special configuration; simply opening a crafted malicious file or playlist entry is sufficient to trigger the exploit.\nThere are no authentication or elevated privilege requirements for exploitation, making it a high-risk vector for remote code execution.\nAttackers can leverage this vulnerability to gain control over the application's memory, bypassing existing size guards due to the flawed validation logic.",
  "technicalDetails": "The root cause of the vulnerability lies within the AllocatePicture function located in src/misc/picture.c. VLC calculates the total memory required for a picture buffer using 32-bit integer arithmetic. Specifically, the expression 'i_bytes += p->i_pitch * p->i_lines' performs the multiplication using 32-bit signed integers because the p->i_pitch and p->i_lines fields in include/vlc_picture.h are declared as 'int'.\nWhen large dimensions are provided in a crafted PNG IHDR chunk, the product of 'p->i_pitch * p->i_lines' overflows the 32-bit integer limit, resulting in a wrapped, smaller value. Although this value is subsequently assigned to a size_t accumulator, the overflow has already occurred. The implementation performs an overflow check using 64-bit arithmetic, but this guard fails to detect the overflow because it does not adequately validate the original 32-bit multiplication result. Furthermore, the check against PICTURE_SW_SIZE_MAX occurs after the wrap, allowing an insufficiently sized buffer to be allocated by aligned_alloc.\nThe attack flow begins when the user opens a malicious PNG file. The image demuxer fails to adequately validate the declared width and height, relying only on the file's total byte count. The decoder in modules/codec/png.c then processes the image data based on the original, large dimensions. Because the heap allocation was performed using the wrapped, small value, the decoder performs out-of-bounds writes into the heap memory. This allows an attacker to control the contents and length of the data written beyond the allocated buffer boundaries.\nThis is a classic heap corruption scenario where an attacker can overwrite adjacent heap chunks with attacker-controlled data. Depending on the memory layout and the specific target architecture, this primitive can be leveraged to corrupt function pointers or other sensitive metadata to divert control flow, ultimately leading to arbitrary code execution. The vulnerability is triggered automatically upon opening the file or a playlist entry containing the malicious file, requiring no user interaction beyond the initial media opening."
}