CVE-2026-124308

CVE-2026-124308CVE-2026-124308

Description

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash.

Scoring

CVSS 5.8 ()
VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Last modified2026-11-07
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.