Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

VVdeC before 3.2.1 has heap use-after-free (CVE-2026-124307)

Original title: CVE-2026-124307: VVdeC/vvdecapp: Heap Use-After-Free in AdaptiveLoopFilter::reconstructCoeff via ALF APS Redefinition

oss-security ()
Read at seclists.org
Part of a story covered by 4 sourcesCVE-2026-124310: VVdeC/vvdecapp: Out-of-Bounds Read in Slice::getRefPic via Overlapping Slice CTU CoverageMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A crafted VVC bitstream that redefines an ALF APS can hit freed memory; the fix commit is 1eddb30.

Alexander A. Shvedov reported CVE-2026-124307, a heap use-after-free in VVdeC AdaptiveLoopFilter::reconstructCoeff when a crafted VVC bitstream redefines an ALF adaptation parameter set. Versions before 3.2.1 are affected. It was reproduced on 3.3.0-dev commit e493ce51. CVSS 3.1 is 5.8 medium: local, high attack complexity, user interaction, with low confidentiality and integrity and high availability impact. The stated fix is commit 1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01.

Unconfirmed: The description is truncated, and the post does not say whether the bug is exploited.

Key facts
  • CWE-416; CVSS 3.1 is 5.8 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H).
  • Affected range is versions before 3.2.1.
  • Reproduced on 3.3.0-dev commit e493ce51f13a2dea72cd58354652ed4e0f509a0e.
  • Fixed commit is 1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01.
Security assessment · AI, from the article

Impact: Local heap use-after-free when decoding a crafted VVC bitstream

ProductAffectedFixed in
vvdecappbefore 3.2.11eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01
What to do
  1. 1.Move VVdeC to 3.2.1 or later, including the stated fix commit.
Analyze CVE-2026-124307 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-124307
Tags
vvdecvvcuse-after-freemedia-decoder
Products
VVdeCvvdecapp

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-124307
Heap use-after-free in Fraunhofer HHI VVdeC before 3.2.1
5.8—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha11eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01-dev Commit e493ce51f13a2dea72cd58354652ed4e0f509a0e Fixed: 1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01 CVE: CVE-2026-124307 CWE: CWE-416 (Use After Free) CVSS 3.1
sha1e493ce51f13a2dea72cd58354652ed4e0f509a0ed: Versions before 3.2.1 Reproduced build: 3.3.0-dev Commit e493ce51f13a2dea72cd58354652ed4e0f509a0e Fixed: 1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01 CVE: CVE-20

From the original article

Posted by Alexander A. Shvedov on Nov 09 Product: VVdeC (vvdecapp) Affected: Versions before 3. 2.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.