CVE-2026-56711

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.

lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.

A vulnerability in the EbmlTypeDispatcher::send function of VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. This may be related to the SDL_Image product.

An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.

An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.