Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

VVdeC through 3.2.1 NULL-dereferences on crafted VVC (CVE-2026-124311)

Original title: CVE-2026-124311: VVdeC/vvdecapp: NULL Pointer Dereference in InterPrediction::xPredInterBlk via Reference Wrap-Around

oss-security ()
Read at seclists.org
Part of a story covered by 4 sourcesCVE-2026-124310: VVdeC/vvdecapp: Out-of-Bounds Read in Slice::getRefPic via Overlapping Slice CTU CoverageMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A local user opening a crafted bitstream can crash vvdecapp; the reported fix is commit fb73aca.

Alexander A. Shvedov reported CVE-2026-124311 in VVdeC (vvdecapp): a NULL pointer dereference in InterPrediction::xPredInterBlk when a crafted VVC bitstream switches to an SPS. Versions through 3.2.1 are affected, and the issue was reproduced on 3.3.0-dev commit 76f087e. CVSS 3.1 is 5.5 medium, local, with user interaction and high availability impact only. The stated fix is commit fb73aca37b48f89814f57edbc8072a37d47bbe06.

Unconfirmed: The feed snippet cuts off the bitstream description, and no exploitation is mentioned.

Key facts
  • CWE-476; CVSS 3.1 base 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
  • Affected versions are through 3.2.1.
  • Reproduced on 3.3.0-dev commit 76f087e5936336b951801576514c0fd42976b7eb.
  • Fixed commit is fb73aca37b48f89814f57edbc8072a37d47bbe06.
Security assessment · AI, from the article

Impact: Local crash of the VVC decoder via a crafted bitstream

ProductAffectedFixed in
vvdecappthrough 3.2.1fb73aca37b48f89814f57edbc8072a37d47bbe06
What to do
  1. 1.Update VVdeC past the affected 3.2.1 line to the stated fix commit.
Analyze CVE-2026-124311 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-124311
Tags
vvdecvvcnull-dereferencemedia-decoder
Products
VVdeCvvdecapp

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-124311
NULL pointer dereference in Fraunhofer VVdeC through 3.2.1
6.8—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha176f087e5936336b951801576514c0fd42976b7eb: Versions through 3.2.1 Reproduced build: 3.3.0-dev Commit 76f087e5936336b951801576514c0fd42976b7eb Fixed: fb73aca37b48f89814f57edbc8072a37d47bbe06 CVE: CVE-20
sha1fb73aca37b48f89814f57edbc8072a37d47bbe06-dev Commit 76f087e5936336b951801576514c0fd42976b7eb Fixed: fb73aca37b48f89814f57edbc8072a37d47bbe06 CVE: CVE-2026-124311 CWE: CWE-476 (NULL Pointer Dereference

From the original article

Posted by Alexander A. Shvedov on Nov 09 Product: VVdeC (vvdecapp) Affected: Versions through 3. 2.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.