CVE-2026-56711CWE-190CWE-787

CVE-2026-56711

High · published September 9, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00120 · 1.7th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-787 · Out-of-bounds Write
Published
2026-09-09T18:17Z
References (1)
https://github.com/videolan/vlc · [email protected]
EPSS history
Timeline
  • 11 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:31Z
    VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation
    cvelistv5