Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

VVdeC before 3.2.1 has heap use-after-free after aborted decode

Original title: CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs after Aborted Picture Decoding

oss-security ()
Read at seclists.org
Part of a story covered by 4 sourcesCVE-2026-124310: VVdeC/vvdecapp: Out-of-Bounds Read in Slice::getRefPic via Overlapping Slice CTU CoverageMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-124308 scores 5.8 and needs local access, high complexity, and user interaction.

Alexander A. Shvedov reported a heap use-after-free in VVdeC's vvdecapp, in DecLibRecon::createSubPicRefBufs after aborted picture decoding. Versions before 3.2.1 are listed as affected, while the bug was reproduced on build 3.3.0-dev. A fix commit is given; the excerpt does not say attackers are using it.

Unconfirmed: Versions before 3.2.1 are listed as affected, but the report says it was reproduced on 3.3.0-dev.

Key facts
  • CVSS 3.1 is 5.8, with high availability impact.
  • The flaw is CWE-416 and CVE-2026-124308.
  • The stated fix commit is 8a0def8ba6050412d33e69a6f1e66e287b039083.
  • The report continues upstream issue #392.
Security assessment · AI, from the article

Impact: Local heap use-after-free with high availability impact

ProductAffectedFixed in
VVdeCbefore 3.2.18a0def8ba6050412d33e69a6f1e66e287b039083
What to do
  1. 1.Apply fix commit 8a0def8ba6050412d33e69a6f1e66e287b039083.
Analyze CVE-2026-124308 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-124308
Tags
vvdecuse-after-freevideo-decodercwe-416
Products
VVdeCvvdecapp

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-124308
Heap use-after-free in Fraunhofer HHI VVdeC before 3.2.1
5.8—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha18a0def8ba6050412d33e69a6f1e66e287b039083-dev Commit e2a596a6524b84d89233d2644896c4d4086ee78f Fixed: 8a0def8ba6050412d33e69a6f1e66e287b039083 CVE: CVE-2026-124308 CWE: CWE-416 (Use After Free) CVSS 3.1
sha1e2a596a6524b84d89233d2644896c4d4086ee78fd: Versions before 3.2.1 Reproduced build: 3.3.0-dev Commit e2a596a6524b84d89233d2644896c4d4086ee78f Fixed: 8a0def8ba6050412d33e69a6f1e66e287b039083 CVE: CVE-20

From the original article

Posted by Alexander A. Shvedov on Nov 10 Product: VVdeC (vvdecapp) Affected: Versions before 3. 2.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.