VVdeC before 3.2.1 has out-of-bounds read (CVE-2026-124310)
Original title: CVE-2026-124310: VVdeC/vvdecapp: Out-of-Bounds Read in Slice::getRefPic via Overlapping Slice CTU Coverage
A crafted VVC bitstream reaches Slice::getRefPic; the issue is CWE-129, scored CVSS 6.1, with a published fix commit.
Alexander A. Shvedov reported an out-of-bounds read in VVdeC's vvdecapp, in Slice::getRefPic, tied to overlapping slice CTU coverage. Versions before 3.2.1 are listed as affected. The report cites CWE-129 and CVSS 3.1 6.1: local access, user interaction, low confidentiality and high availability. The mailing-list description is truncated.
Unconfirmed: Affected versions are listed as before 3.2.1, yet the bug was reproduced on 3.3.0-dev, and the description is truncated.
- The bug was reproduced on build 3.3.0-dev at commit e2a596a.
- The stated fix is commit 32b842c10bf024f09bc7cf1445fa6f8a987422ca.
- The vector is local, needs user interaction, and requires no privileges.
- Scores show low confidentiality and high availability, with no integrity impact.
Impact: Local out-of-bounds read from a crafted VVC bitstream
| Product | Affected | Fixed in |
|---|---|---|
| VVdeC (vvdecapp) | before 3.2.1 | 32b842c10bf024f09bc7cf1445fa6f8a987422ca |
- 1.Apply fix commit 32b842c10bf024f09bc7cf1445fa6f8a987422ca; versions before 3.2.1 are affected.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124310 | Out-of-bounds read in Fraunhofer HHI VVdeC before 3.2.1 | 6.9 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 32b842c10bf024f09bc7cf1445fa6f8a987422ca | -dev Commit e2a596a6524b84d89233d2644896c4d4086ee78f Fixed: 32b842c10bf024f09bc7cf1445fa6f8a987422ca CVE: CVE-2026-124310 CWE: CWE-129 (Improper Validation of A |
| sha1 | e2a596a6524b84d89233d2644896c4d4086ee78f | d: Versions before 3.2.1 Reproduced build: 3.3.0-dev Commit e2a596a6524b84d89233d2644896c4d4086ee78f Fixed: 32b842c10bf024f09bc7cf1445fa6f8a987422ca CVE: CVE-20 |
From the original article
Posted by Alexander A. Shvedov on Nov 11 Product: VVdeC (vvdecapp) Affected: Versions before 3. 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.