The flaw arises from an integer overflow during picture buffer allocation in VLC media player. Size is calculated using 32‑bit arithmetic on a product of pitch and lines, wrapped before promotion to the 64‑bit accumulator. The guard that should prevent overflow operates on the widened value and does not constrain the wrapped product. Consequently, the allocator reserves a too‑small buffer, and subsequent decoder writes overwrite memory beyond the allocation. This heap out‑of‑bounds write can corrupt program state and potentially allow arbitrary code execution when a crafted image is processed.

All versions of VideoLAN VLC media player from 3.0.0 up to and including 3.0.23 are affected. No sub‑version specific patches are listed; the vulnerability resides in the core picture allocation routines shared across these releases.

The CVSS score of 8.6 indicates a high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector is straightforward: a malicious PNG file with a large declared width and height can be provided as a file or playlist entry and processed by VLC with default settings. If the user opens such a file, the decoder writes beyond the buffer, creating an exploitable memory condition.