{"id":"CVE-2026-124309","kind":"vulnerability","aliases":["CVE-2026-124309"],"related":[],"title":"VVdeC: crafted VVC bitstream reads past heap, crashes decoder or leaks memory","description":"Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI to crash the decoder or copy adjacent heap memory.","summary":"VVdeC is Fraunhofer HHI's open-source decoder for the VVC video format. A crafted VVC bitstream with a nested SEI message makes the decoder read past a heap allocation, which can crash it or copy adjacent heap memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","video-decoding","vvdec"],"not_affected_if":["no-untrusted-vvc-input","vvdec-3.2.1-or-later"],"how_to_check":"- Check the installed VVdeC version against the `3.2.1` fixed release.\n- Find whether an application links VVdeC or the `vvdec` library and decodes untrusted VVC input.","fix":"- VVdeC `3.2.1` (fixed version per the NVD description: versions before 3.2.1 are affected).","status":"open","published_at":"2026-11-07T15:17:14+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","triaged_at":"2026-11-07T15:48:14+00:00","updated_at":"2026-11-07T15:48:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T15:48:14Z","model":"claude-haiku-5-5","output":{"fix":"- VVdeC `3.2.1` (fixed version per the NVD description: versions before 3.2.1 are affected).","reach":"unknown","title":"VVdeC: crafted VVC bitstream reads past heap, crashes decoder or leaks memory","impact":"medium","summary":"VVdeC is Fraunhofer HHI's open-source decoder for the VVC video format. A crafted VVC bitstream with a nested SEI message makes the decoder read past a heap allocation, which can crash it or copy adjacent heap memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["vvdec","video-decoding","c++"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"decoder crashes or adjacent heap memory is copied out","analyst_note":"","how_to_check":"- Check the installed VVdeC version against the `3.2.1` fixed release.\n- Find whether an application links VVdeC or the `vvdec` library and decodes untrusted VVC input.","plain_action":"","needs_analyst":false,"not_affected_if":["vvdec-3.2.1-or-later","no-untrusted-vvc-input"],"who_is_affected":"Applications that decode VVC video from untrusted sources with VVdeC versions before 3.2.1 are exposed. Systems that only decode trusted local files, or do not use VVdeC, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4318,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124309':15A,18A '-2026':14A,17A '3.2.1':69C 'adjac':62B,124C 'alloc':55B,89C 'allow':83C 'attack':84C,100C 'bitstream':4A,42B,106C 'bound':76C 'buffer':115C 'c':19B 'cast':91C 'contain':70C,112C 'copi':61B,123C 'craft':2A,40B,104C 'crash':8A,58B,119C 'cve':13A,16A 'decod':9A,23B,33B,50B,121C 'format':38B 'fraunhof':27B,65C 'heap':7A,54B,63B,72C,88C,125C 'hhi':28B,66C 'instead':96C 'leak':11A 'make':48B 'memori':12A,64B,126C 'messag':47B 'nest':45B,110C,114C 'object':95C 'open':31B 'open-sourc':30B 'out-of-bound':73C 'packag':20B 'past':6A,52B,87C 'payload':99C 'period':116C 'read':5A,51B,77C,86C 'scalabl':109C 'sei':46B,93C,111C,117C 'seiread':80C 'sourc':32B 'suppli':102C 'video':22B,37B 'video-decod':21B 'vulner':78C 'vvc':3A,36B,41B,105C 'vvdec':1A,24B,25B,67C 'wrapper':94C 'xparseseiscalablenest':81C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode VVC video from untrusted sources with VVdeC versions before 3.2.1 are exposed. Systems that only decode trusted local files, or do not use VVdeC, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","medium","package","videodecoding","vvdec"],"campaign_type":null,"search_a":"'-124309':15A,18A '-2026':14A,17A 'bitstream':4A 'craft':2A 'crash':8A 'cve':13A,16A 'decod':9A 'heap':7A 'leak':11A 'memori':12A 'past':6A 'read':5A 'vvc':3A 'vvdec':1A","search_b":"'adjac':62B 'alloc':55B 'bitstream':42B 'c':19B 'copi':61B 'craft':40B 'crash':58B 'decod':23B,33B,50B 'format':38B 'fraunhof':27B 'heap':54B,63B 'hhi':28B 'make':48B 'memori':64B 'messag':47B 'nest':45B 'open':31B 'open-sourc':30B 'packag':20B 'past':52B 'read':51B 'sei':46B 'sourc':32B 'video':22B,37B 'video-decod':21B 'vvc':36B,41B 'vvdec':24B,25B","search_c":"'3.2.1':69C 'adjac':124C 'alloc':89C 'allow':83C 'attack':84C,100C 'bitstream':106C 'bound':76C 'buffer':115C 'cast':91C 'contain':70C,112C 'copi':123C 'craft':104C 'crash':119C 'decod':121C 'fraunhof':65C 'heap':72C,88C,125C 'hhi':66C 'instead':96C 'memori':126C 'nest':110C,114C 'object':95C 'out-of-bound':73C 'past':87C 'payload':99C 'period':116C 'read':77C,86C 'scalabl':109C 'sei':93C,111C,117C 'seiread':80C 'suppli':102C 'vulner':78C 'vvc':105C 'vvdec':67C 'wrapper':94C 'xparseseiscalablenest':81C","first_public_at":"2026-11-07T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124309","severity":null,"published_at":"2026-11-07T15:17:14+00:00","modified_at":"2026-11-07T15:17:14+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","fetched_at":"2026-11-07T15:47:57+00:00","note":null}],"documents":[{"id":96359,"url":"https://github.com/fraunhoferhhi/vvdec/commit/1d657c7a822987d2ff935e9c227c5faf5318ca06","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96360,"url":"https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-heap-out-of-bounds-read-via-seireader-xparseseiscalablenesting","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}