CVE-2026-124307 · Package
NO FIX YET · SEE WHAT TO DO
VVdeC, Fraunhofer HHI's VVC video decoder library, frees an ALF adaptation parameter set that slices still reference when a bitstream redefines it. With multithreaded decoding, worker threads then read the freed object, which can crash the decoder or corrupt heap memory.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that decode VVC video with the VVdeC library, especially with multithreaded decoding, when the bitstream comes from an untrusted source. Systems that only decode trusted streams or do not use VVdeC can skip it.
Not affected if no-vvdec-usage, single-threaded-decoding, trusted-input-only
Who cares c++, video-decoding, vvc, vvdec
unknown if the sources do not name a command; look for VVdeC in your dependency manifests or build files3.2.1 (fix is stated as 'before 3.2.1' in the product range)Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.