{"id":"CVE-2026-124310","kind":"vulnerability","aliases":["CVE-2026-124310"],"related":[],"title":"VVdeC: out-of-bounds read lets crafted bitstreams crash the video decoder","description":"Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index, causing Slice::getRefPic to read outside m_apcRefPicList and crash decoding.","summary":"VVdeC is Fraunhofer HHI's VVC video decoder library. A crafted bitstream with overlapping slice coverage makes it read outside a reference picture list, crashing decoding.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","video-decoding","vvc","vvdec"],"not_affected_if":["no-vvdec-in-use","trusted-input-only"],"how_to_check":"- Check the installed VVdeC version against the library's version output or package manifest\n- Look for VVdeC in your dependencies or in apps that embed the decoder","fix":"- VVdeC: upgrade to `3.2.1` or later","status":"open","published_at":"2026-11-07T15:17:14+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","triaged_at":"2026-11-07T15:48:13+00:00","updated_at":"2026-11-07T15:48:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T15:48:13Z","model":"claude-haiku-5-5","output":{"fix":"- VVdeC: upgrade to `3.2.1` or later","reach":"unknown","title":"VVdeC: out-of-bounds read lets crafted bitstreams crash the video decoder","impact":"low","summary":"VVdeC is Fraunhofer HHI's VVC video decoder library. A crafted bitstream with overlapping slice coverage makes it read outside a reference picture list, crashing decoding.","audience":"developers","category":"package","nicknames":[],"who_cares":["vvdec","video-decoding","vvc"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Decoder process crashes on a crafted bitstream, causing denial of service","analyst_note":"","how_to_check":"- Check the installed VVdeC version against the library's version output or package manifest\n- Look for VVdeC in your dependencies or in apps that embed the decoder\n- unknown whether other checks apply","plain_action":"","needs_analyst":false,"not_affected_if":["no-vvdec-in-use","trusted-input-only"],"who_is_affected":"Applications that embed VVdeC to decode untrusted VVC video streams are exposed to a crash through a crafted bitstream. Services that decode only trusted or locally produced content, or that do not use VVdeC, can skip it. Denial of service is the stated impact; the sources do not describe code execution.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":4331,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124310':16A,19A '-2026':15A,18A '3.2.1':56C 'allow':66C 'apcrefpiclist':109C 'attack':67C,80C 'bdof':94C 'bi':92C 'bi-predict':91C 'bitstream':9A,37B,74C 'bound':5A,62C 'carri':97C 'caus':102C 'code':82C,95C 'contain':57C 'coverag':41B,79C 'craft':8A,36B 'crash':10A,50B,69C,111C 'ctu':78C,84C 'cve':14A,17A 'decod':13A,23B,33B,51B,71C,112C 'fraunhof':28B,52C 'getrefp':104C 'hhi':29B,53C 'index':101C 'let':7A 'librari':34B 'list':49B 'm':108C 'make':42B 'negat':99C 'out-of-bound':2A,59C 'outsid':45B,107C 'overlap':39B,76C 'packag':20B 'pictur':48B 'predict':93C 'read':6A,44B,63C,106C 'refer':47B,100C 'second':87C 'slice':40B,77C,88C,103C 'suppli':73C 'unit':96C 'video':12A,22B,32B 'video-decod':21B 'vulner':64C 'vvc':24B,31B 'vvdec':1A,25B,26B,54C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed VVdeC to decode untrusted VVC video streams are exposed to a crash through a crafted bitstream. Services that decode only trusted or locally produced content, or that do not use VVdeC, can skip it. Denial of service is the stated impact; the sources do not describe code execution.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","videodecoding","vvc","vvdec"],"campaign_type":null,"search_a":"'-124310':16A,19A '-2026':15A,18A 'bitstream':9A 'bound':5A 'craft':8A 'crash':10A 'cve':14A,17A 'decod':13A 'let':7A 'out-of-bound':2A 'read':6A 'video':12A 'vvdec':1A","search_b":"'bitstream':37B 'coverag':41B 'craft':36B 'crash':50B 'decod':23B,33B,51B 'fraunhof':28B 'hhi':29B 'librari':34B 'list':49B 'make':42B 'outsid':45B 'overlap':39B 'packag':20B 'pictur':48B 'read':44B 'refer':47B 'slice':40B 'video':22B,32B 'video-decod':21B 'vvc':24B,31B 'vvdec':25B,26B","search_c":"'3.2.1':56C 'allow':66C 'apcrefpiclist':109C 'attack':67C,80C 'bdof':94C 'bi':92C 'bi-predict':91C 'bitstream':74C 'bound':62C 'carri':97C 'caus':102C 'code':82C,95C 'contain':57C 'coverag':79C 'crash':69C,111C 'ctu':78C,84C 'decod':71C,112C 'fraunhof':52C 'getrefp':104C 'hhi':53C 'index':101C 'm':108C 'negat':99C 'out-of-bound':59C 'outsid':107C 'overlap':76C 'predict':93C 'read':63C,106C 'refer':100C 'second':87C 'slice':77C,88C,103C 'suppli':73C 'unit':96C 'vulner':64C 'vvdec':54C","first_public_at":"2026-11-07T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124310","severity":null,"published_at":"2026-11-07T15:17:14+00:00","modified_at":"2026-11-07T15:17:14+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","fetched_at":"2026-11-07T15:47:57+00:00","note":null}],"documents":[{"id":96361,"url":"https://github.com/fraunhoferhhi/vvdec/commit/32b842c10bf024f09bc7cf1445fa6f8a987422ca","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96362,"url":"https://github.com/fraunhoferhhi/vvdec/commit/6e4b907ef5ab9db390b1293ba1ad5d7dd0a67e3f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96363,"url":"https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-out-of-bounds-read-via-slice-getrefpic","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}