Use-after-free in Fraunhofer HHI VVdeC via ALF APS redefinition
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Fraunhofer HHI VVdeC from 0 before 3.2.1 contains a use-after-free flaw (CWE-416) that occurs when an ALF adaptation parameter set ID still referenced by slices is redefined. An attacker who supplies a crafted VVC bitstream can make worker threads access freed objects during multithreaded decoding, causing crashes or heap corruption.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fraunhoferhhi | vvdec | before 3.2.1 | 3.2.1 | Patch available | CNA |
- vvdec Vendorfraunhoferhhi Affected before 3.2.1 Fixed in 3.2.1 Patch available CNA
Remediation
Upgrade VVdeC to version 3.2.1, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA vvdec (fraunhoferhhi) Fixed in 3.2.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
fraunhoferhhi vvdec 3.2.1
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2026-86610 Out-of-bounds read in Fraunhofer HHI VVdeC decoderPriority MEDIUM 46
- TI-2026-86609 Heap out-of-bounds read in Fraunhofer HHI VVdeC SEI parsingPriority MEDIUM 46
- TI-2026-86608 Use-after-free in Fraunhofer HHI VVdeC multi-threaded decodingPriority MEDIUM 41
Timeline
- 2026-11-07 Threatist record created from CVE-2026-124307
- 2026-11-07 Alias added: GHSA-crhc-4fp3-m233
References
Other 6
- https://github.com/fraunhoferhhi/vvdec/issues/391
- https://github.com/fraunhoferhhi/vvdec/issues/390
- https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/Slice.h#L2570
- https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/ParameterSetManager.h#L97
- https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/DecoderLib/CABACReader.cpp#L428-L429
- https://github.com/fraunhoferhhi/vvdec
More fraunhoferhhi vulnerabilities
- TI-2026-86610 Out-of-bounds read in Fraunhofer HHI VVdeC decoder CVSS 4.0MEDIUM 6.9
- TI-2026-86609 Heap out-of-bounds read in Fraunhofer HHI VVdeC SEI parsing CVSS 4.0MEDIUM 6.9
- TI-2026-86611 VVdeC NULL Pointer Dereference via InterPrediction::xPredInterBlk CVSS 4.0MEDIUM 6.8
- TI-2026-86612 Heap out-of-bounds read in Fraunhofer HHI VVdeC decoder CVSS 4.0MEDIUM 5.7
- TI-2026-86608 Use-after-free in Fraunhofer HHI VVdeC multi-threaded decoding CVSS 4.0MEDIUM 5.8
Sources
- CVE-2026-124307 · CVE Program
- CVE-2026-124307 · NVD
- GHSA-crhc-4fp3-m233 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences