CVE-2026-124309 · Package
NO FIX YET · SEE WHAT TO DO
VVdeC is Fraunhofer HHI's open-source decoder for the VVC video format. A crafted VVC bitstream with a nested SEI message makes the decoder read past a heap allocation, which can crash it or copy adjacent heap memory.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that decode VVC video from untrusted sources with VVdeC versions before 3.2.1 are exposed. Systems that only decode trusted local files, or do not use VVdeC, can skip it.
Not affected if no-untrusted-vvc-input, vvdec-3.2.1-or-later
Who cares c++, video-decoding, vvdec
3.2.1 fixed release.vvdec library and decodes untrusted VVC input.3.2.1 (fixed version per the NVD description: versions before 3.2.1 are affected).Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI to crash the decoder or copy adjacent heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.