VVdeC before 3.2.1 has heap use-after-free (CVE-2026-124308)
Original title: CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs during Subpicture Reconstruction
Subpicture reconstruction keeps raw pointers after free; the local, user-assisted bug is rated CVSS 5.8.
Alexander A. Shvedov reported a heap use-after-free in VVdeC’s vvdecapp, CVE-2026-124308, in DecLibRecon::createSubPicRefBufs during subpicture reconstruction. Versions before 3.2.1 are affected. The issue was reproduced on a 3.3.0-dev build at commit e493ce51 and fixed in commit 8a0def8ba6050412d33e69a6f1e66e287b039083. The posted snippet says subpicture border-extension tasks retain raw pointers.
Unconfirmed: The feed snippet cuts off before the full trigger and impact description.
- CWE-416; CVSS 3.1 base score 5.8 medium.
- Vector is local, high complexity, no privileges, and user interaction required.
- Impact ratings are low confidentiality and integrity, high availability.
Impact: Local use-after-free with limited data impact and high availability impact
| Product | Affected | Fixed in |
|---|---|---|
| VVdeC (vvdecapp) | before 3.2.1 | 8a0def8ba6050412d33e69a6f1e66e287b039083 |
- 1.Update VVdeC to a build that includes commit 8a0def8ba6050412d33e69a6f1e66e287b039083.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124308 | Heap use-after-free in Fraunhofer HHI VVdeC before 3.2.1 | 5.8 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 8a0def8ba6050412d33e69a6f1e66e287b039083 | -dev Commit e493ce51f13a2dea72cd58354652ed4e0f509a0e Fixed: 8a0def8ba6050412d33e69a6f1e66e287b039083 CVE: CVE-2026-124308 CWE: CWE-416 (Use After Free) CVSS 3.1 |
| sha1 | e493ce51f13a2dea72cd58354652ed4e0f509a0e | d: Versions before 3.2.1 Reproduced build: 3.3.0-dev Commit e493ce51f13a2dea72cd58354652ed4e0f509a0e Fixed: 8a0def8ba6050412d33e69a6f1e66e287b039083 CVE: CVE-20 |
From the original article
Posted by Alexander A. Shvedov on Nov 11 Product: VVdeC (vvdecapp) Affected: Versions before 3. 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.