VVdeC before 3.2.1 has heap out-of-bounds read (CVE-2026-124309)
Original title: CVE-2026-124309: VVdeC/vvdecapp: Heap Out-of-Bounds Read in HRD::setBufferingPeriodSEI via Scalable-Nesting SEI
Parsing a scalable-nesting SEI can read past a heap buffer; the local bug is rated CVSS 6.1.
Alexander A. Shvedov reported a heap out-of-bounds read in VVdeC’s vvdecapp, CVE-2026-124309, in HRD::setBufferingPeriodSEI when parsing a scalable-nesting SEI. Versions before 3.2.1 are affected. It was reproduced on 3.3.0-dev commit e493ce51 and fixed in commit 1d657c7a822987d2ff935e9c227c5faf5318ca06. The advisory classifies it as CWE-125.
Unconfirmed: The feed snippet ends during the description of the scalable-nesting SEI parse.
- CVSS 3.1 base score is 6.1 medium.
- Vector is local, low complexity, no privileges, and user interaction required.
- Impact is low confidentiality, none for integrity, and high availability.
Impact: Local heap out-of-bounds read with high availability impact
| Product | Affected | Fixed in |
|---|---|---|
| VVdeC (vvdecapp) | before 3.2.1 | 1d657c7a822987d2ff935e9c227c5faf5318ca06 |
- 1.Update VVdeC to a build that includes commit 1d657c7a822987d2ff935e9c227c5faf5318ca06.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124309 | Heap out-of-bounds read in Fraunhofer VVdeC before 3.2.1 | 6.9 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 1d657c7a822987d2ff935e9c227c5faf5318ca06 | -dev Commit e493ce51f13a2dea72cd58354652ed4e0f509a0e Fixed: 1d657c7a822987d2ff935e9c227c5faf5318ca06 CVE: CVE-2026-124309 CWE: CWE-125 (Out-of-bounds Read) CVSS |
| sha1 | e493ce51f13a2dea72cd58354652ed4e0f509a0e | d: Versions before 3.2.1 Reproduced build: 3.3.0-dev Commit e493ce51f13a2dea72cd58354652ed4e0f509a0e Fixed: 1d657c7a822987d2ff935e9c227c5faf5318ca06 CVE: CVE-20 |
From the original article
Posted by Alexander A. Shvedov on Nov 11 Product: VVdeC (vvdecapp) Affected: Versions before 3. 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.