VLC media player improperly calculates the size of a picture buffer in AllocatePicture due to 32-bit integer overflow in the multiplication of pitch and lines fields, which are declared as int. The overflow check uses 64-bit arithmetic but does not constrain the 32-bit product, allowing the allocation size to wrap around and become smaller than intended. Consequently, aligned_alloc reserves insufficient memory, but the decoder writes scanlines based on the original large dimensions from a crafted PNG file's IHDR chunk. This leads to a heap buffer overflow when the file is opened directly or via a playlist entry. The only size guard is on the input file's byte count, not the declared image dimensions.

Successful exploitation can result in heap buffer overflow, potentially allowing an attacker to execute arbitrary code or cause a denial of service by crashing VLC media player. The vulnerability requires user interaction to open a malicious PNG file or playlist entry. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted or suspicious PNG files or playlists in VLC media player versions 3.0.0 through 3.0.23. Monitor official VideoLAN channels for updates and apply patches promptly once released.