CVE-2026-124310: VVdeC/vvdecapp: Out-of-Bounds Read in Slice::getRefPic via Overlapping Slice CTU Coverage
A crafted VVC bitstream reaches Slice::getRefPic; the issue is CWE-129, scored CVSS 6.1, with a published fix commit.
Alexander A. Shvedov reported an out-of-bounds read in VVdeC's vvdecapp, in Slice::getRefPic, tied to overlapping slice CTU coverage. Versions before 3.2.1 are listed as affected. The report cites CWE-129 and CVSS 3.1 6.1: local access, user interaction, low confidentiality and high availability. The mailing-list description is truncated.
- The bug was reproduced on build 3.3.0-dev at commit e2a596a.
- The stated fix is commit 32b842c10bf024f09bc7cf1445fa6f8a987422ca.
- The vector is local, needs user interaction, and requires no privileges.
- Scores show low confidentiality and high availability, with no integrity impact.
Coverage
oldest first · one row per article · UTC- · 2d ago
oss-securityFirst report
VVdeC before 3.2.1 has heap use-after-free (CVE-2026-124307)
A crafted VVC bitstream that redefines an ALF APS can hit freed memory; the fix commit is 1eddb30.
- · 2d ago
VVdeC through 3.2.1 NULL-dereferences on crafted VVC (CVE-2026-124311)
A local user opening a crafted bitstream can crash vvdecapp; the reported fix is commit fb73aca.
- · 1d ago
VVdeC before 3.2.1 has heap use-after-free after aborted decode
CVE-2026-124308 scores 5.8 and needs local access, high complexity, and user interaction.
- · 3h ago
VVdeC before 3.2.1 has out-of-bounds read (CVE-2026-124310)
A crafted VVC bitstream reaches Slice::getRefPic; the issue is CWE-129, scored CVSS 6.1, with a published fix commit.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-124310+3 related CVEs | Out-of-bounds read in Fraunhofer HHI VVdeC before 3.2.1 | 6.9 group max | — |