---
id: "CVE-2026-124311"
page: "https://infrastack.ai/live/CVE-2026-124311"
kind: "vulnerability"
aliases: ["CVE-2026-124311"]
title: "VVdeC: crafted VVC bitstream crashes decoder via reference wrap-around"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "package", "video-decoding", "vvc", "vvdec"]
not_affected_if: ["no-vvc-decoding", "trusted-input-only"]
published_at: "2026-11-07T15:17:14+00:00"
first_seen_at: "2026-11-07T15:47:57+00:00"
updated_at: "2026-11-07T15:48:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124311", "first_seen_at": "2026-11-07T15:47:57+00:00"}]
exploit_sources: []
---

# VVdeC: crafted VVC bitstream crashes decoder via reference wrap-around

Link for people: https://infrastack.ai/live/CVE-2026-124311 (this .md is for agents)

VVdeC, Fraunhofer HHI's VVC video decoder, dereferences a NULL pointer in InterPrediction::xPredInterBlk when a new SPS enables reference wrap-around. An attacker who supplies a crafted VVC bitstream can crash the decoder, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your application links VVdeC or invokes it to decode VVC streams, and at what version (affected through `3.2.1`).
- Find out whether the decoder processes streams from untrusted sources such as uploads or network feeds.

## Fix

- VVdeC: the sources link a patch but do not state the fixed version; affected through `3.2.1`.

## Timeline

- 2026-11-07T15:47:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124311

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-through-3.2.1-null-pointer-dereference-via-interprediction-xpredinterblk
- [fix] Patch: github.com https://github.com/fraunhoferhhi/vvdec/commit/fb73aca37b48f89814f57edbc8072a37d47bbe06

## From the sources

Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with sps_ref_wraparound_enabled_flag set, causing reads from missing PIC_RECON_WRAP buffers and denial of service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_