{"id":"CVE-2026-124307","kind":"vulnerability","aliases":["CVE-2026-124307"],"related":[],"title":"VVdeC: heap use-after-free in VVC decoder lets crafted bitstreams corrupt memory","description":"Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption.","summary":"VVdeC, Fraunhofer HHI's VVC video decoder library, frees an ALF adaptation parameter set that slices still reference when a bitstream redefines it. With multithreaded decoding, worker threads then read the freed object, which can crash the decoder or corrupt heap memory.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","video-decoding","vvc","vvdec"],"not_affected_if":["no-vvdec-usage","single-threaded-decoding","trusted-input-only"],"how_to_check":"- Check the installed VVdeC version: `unknown` if the sources do not name a command; look for VVdeC in your dependency manifests or build files\n- Check whether you decode untrusted VVC bitstreams with multithreaded decoding enabled","fix":"- VVdeC: `3.2.1` (fix is stated as 'before 3.2.1' in the product range)","status":"open","published_at":"2026-11-07T15:17:14+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","triaged_at":"2026-11-07T15:48:18+00:00","updated_at":"2026-11-07T15:48:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T15:48:18Z","model":"claude-haiku-5-5","output":{"fix":"- VVdeC: `3.2.1` (fix is stated as 'before 3.2.1' in the product range)","reach":"network","title":"VVdeC: heap use-after-free in VVC decoder lets crafted bitstreams corrupt memory","impact":"medium","summary":"VVdeC, Fraunhofer HHI's VVC video decoder library, frees an ALF adaptation parameter set that slices still reference when a bitstream redefines it. With multithreaded decoding, worker threads then read the freed object, which can crash the decoder or corrupt heap memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["vvdec","vvc","video-decoding","c++"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"crash or heap memory corruption while decoding a crafted stream","analyst_note":"","how_to_check":"- Check the installed VVdeC version: `unknown` if the sources do not name a command; look for VVdeC in your dependency manifests or build files\n- Check whether you decode untrusted VVC bitstreams with multithreaded decoding enabled","plain_action":"","needs_analyst":false,"not_affected_if":["single-threaded-decoding","trusted-input-only","no-vvdec-usage"],"who_is_affected":"Applications that decode VVC video with the VVdeC library, especially with multithreaded decoding, when the bitstream comes from an untrusted source. Systems that only decode trusted streams or do not use VVdeC can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4341,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124307':17A,20A '-2026':16A,19A '3.2.1':74C 'adapt':39B,93C 'adaptiveloopfilt':123C 'alf':38B,92C 'allow':84C 'ap':117C 'attack':85C,101C 'bitstream':12A,48B,107C 'c':21B 'cabacread':120C 'caus':125C 'contain':75C 'corrupt':13A,67B,87C,129C 'craft':11A,105C 'crash':63B,126C 'cve':15A,18A 'decod':9A,25B,34B,53B,65B,111C 'derefer':115C 'fraunhof':29B,70C 'free':6A,36B,81C 'freed':59B,116C 'heap':2A,68B,77C,128C 'hhi':30B,71C 'id':96C 'let':10A 'librari':35B 'make':112C 'memori':14A,69B,88C 'multithread':52B,110C 'object':60B,118C 'packag':22B 'paramet':40B,94C 'read':57B 'readalf':121C 'reconstructcoeff':124C 'redefin':49B,90C 'refer':45B 'referenc':98C 'set':41B,95C 'slice':43B,100C 'still':44B,97C 'suppli':103C 'thread':55B,114C 'use':4A,79C 'use-after-fre':3A,78C 'video':24B,33B 'video-decod':23B 'vulner':82C 'vvc':8A,26B,32B,106C 'vvdec':1A,27B,28B,72C 'worker':54B,113C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode VVC video with the VVdeC library, especially with multithreaded decoding, when the bitstream comes from an untrusted source. Systems that only decode trusted streams or do not use VVdeC can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","medium","package","videodecoding","vvc","vvdec"],"campaign_type":null,"search_a":"'-124307':17A,20A '-2026':16A,19A 'bitstream':12A 'corrupt':13A 'craft':11A 'cve':15A,18A 'decod':9A 'free':6A 'heap':2A 'let':10A 'memori':14A 'use':4A 'use-after-fre':3A 'vvc':8A 'vvdec':1A","search_b":"'adapt':39B 'alf':38B 'bitstream':48B 'c':21B 'corrupt':67B 'crash':63B 'decod':25B,34B,53B,65B 'fraunhof':29B 'free':36B 'freed':59B 'heap':68B 'hhi':30B 'librari':35B 'memori':69B 'multithread':52B 'object':60B 'packag':22B 'paramet':40B 'read':57B 'redefin':49B 'refer':45B 'set':41B 'slice':43B 'still':44B 'thread':55B 'video':24B,33B 'video-decod':23B 'vvc':26B,32B 'vvdec':27B,28B 'worker':54B","search_c":"'3.2.1':74C 'adapt':93C 'adaptiveloopfilt':123C 'alf':92C 'allow':84C 'ap':117C 'attack':85C,101C 'bitstream':107C 'cabacread':120C 'caus':125C 'contain':75C 'corrupt':87C,129C 'craft':105C 'crash':126C 'decod':111C 'derefer':115C 'fraunhof':70C 'free':81C 'freed':116C 'heap':77C,128C 'hhi':71C 'id':96C 'make':112C 'memori':88C 'multithread':110C 'object':118C 'paramet':94C 'readalf':121C 'reconstructcoeff':124C 'redefin':90C 'referenc':98C 'set':95C 'slice':100C 'still':97C 'suppli':103C 'thread':114C 'use':79C 'use-after-fre':78C 'vulner':82C 'vvc':106C 'vvdec':72C 'worker':113C","first_public_at":"2026-11-07T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124307","severity":null,"published_at":"2026-11-07T15:17:14+00:00","modified_at":"2026-11-07T15:17:14+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","fetched_at":"2026-11-07T15:47:57+00:00","note":null}],"documents":[{"id":96355,"url":"https://github.com/fraunhoferhhi/vvdec/commit/1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96356,"url":"https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-heap-use-after-free-via-alf-aps-redefinition","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}