VVdeC before 3.2.1 has out-of-bounds read (CVE-2026-124310)
A crafted VVC bitstream reaches Slice::getRefPic; the issue is CWE-129, scored CVSS 6.1, with a published fix commit.
46
- Mentions · 7d4
- Mentions · 30d4
- All mentions4
- First seenNov 9, 2026
- Last mentioned3h ago
Timeline
4 articles · newest firstVVdeC before 3.2.1 has heap use-after-free after aborted decode
CVE-2026-124308 scores 5.8 and needs local access, high complexity, and user interaction.
40
VVdeC through 3.2.1 NULL-dereferences on crafted VVC (CVE-2026-124311)
A local user opening a crafted bitstream can crash vvdecapp; the reported fix is commit fb73aca.
42
VVdeC before 3.2.1 has heap use-after-free (CVE-2026-124307)
A crafted VVC bitstream that redefines an ALF APS can hit freed memory; the fix commit is 1eddb30.
44
Related CVEs
by mentions- Out-of-bounds read in Fraunhofer HHI VVdeC before 3.2.1
- NULL pointer dereference in Fraunhofer VVdeC through 3.2.1
- Heap use-after-free in Fraunhofer HHI VVdeC before 3.2.1
- Heap use-after-free in Fraunhofer HHI VVdeC before 3.2.1
Appears with
- vvdecappproduct · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.