Heap out-of-bounds read in Fraunhofer HHI VVdeC through 3.2.1
Fraunhofer HHI VVdeC through 3.2.1 has a heap out-of-bounds read in CodingStructure::getColInfo. A local attacker can crash the decoder by supplying a VVC bitstream that enables TMVP with a smaller collocated reference picture, so getColInfo reads past the colMotion allocation when error concealment is on. Impact is denial of service only. Anyone decoding untrusted VVC with that build and error concealment enabled is affected.
What to do: Fraunhofer HHI has not listed a fixed release; avoid decoding untrusted VVC bitstreams with error concealment enabled on VVdeC through 3.2.1.
| Product | Affected |
|---|---|
| Fraunhofer HHI VVdeC | through 3.2.1 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColInfo to read past the colMotion allocation when error concealment is enabled.
Product: VVdeC (vvdecapp) Affected: Versions through 3.2.1 Reproduced build: 3.3.0-dev Commit d3049dc6ddccfacca90d8451123549b49f3b0f56 Fixed: 0695c06221c27b3680fec9851ac2cf46b2195ea9 CVE: CVE-2026-124312 CWE: CWE-125…
Today 1.6K readers · 2.4K views · 776 reads · all time 189K views