VVdeC through 3.2.1 NULL-dereferences on crafted VVC (CVE-2026-124311)
A local user opening a crafted bitstream can crash vvdecapp; the reported fix is commit fb73aca.
42
CVE-2026-124311
NULL pointer dereference in Fraunhofer VVdeC through 3.2.1
- CVSS 4.0
- 6.8 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Fraunhofer HHI VVdeC through 3.2.1 has a NULL pointer dereference in InterPrediction::xPredInterBlk. A local attacker who gets a user to open a crafted VVC bitstream can switch the sequence parameter set so sps_ref_wraparound_enabled_flag is set. The decoder then reads missing PIC_RECON_WRAP buffers and crashes, causing denial of service. Only availability is affected.
What to do: No fixed version is stated. Apply Fraunhofer HHI's update for CVE-2026-124311.
| Product | Affected |
|---|---|
| Fraunhofer HHI VVdeC | through 3.2.1 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with sps_ref_wraparound_enabled_flag set, causing reads from missing PIC_RECON_WRAP buffers and denial of service.
- Weakness
- CWE-476
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X