CVE-2026-124308 · Package
NO FIX YET · SEE WHAT TO DO
VVdeC is Fraunhofer HHI's open-source VVC video decoder library. A crafted multi-subpicture VVC bitstream decoded with two or more threads can trigger a heap use-after-free, corrupting memory or crashing the decoder.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed VVdeC to decode VVC video, especially with multi-threaded decoding enabled. Systems that never decode untrusted VVC streams with the library are at much lower risk. unknown whether the linked advisories add further detail.
Not affected if no-vvc-decoding, single-threaded-decoding, trusted-input-only
Who cares c++, video-decoding, vvdec
vvdec --version or the version in your package manifest.3.2.1 or later (per the NVD description: before 3.2.1 is affected).Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.