Use-after-free in Fraunhofer HHI VVdeC multi-threaded decoding
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free in DecLibRecon::createSubPicRefBufs (CWE-416). The decompressPicture function clears pending subpicture tasks without waiting for them to finish. An attacker who supplies a crafted multi-subpicture VVC bitstream to a decoder using two or more threads can corrupt heap memory or crash the decoder.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fraunhoferhhi | vvdec | before 3.2.1 | 3.2.1 | Patch available | CNA |
- vvdec Vendorfraunhoferhhi Affected before 3.2.1 Fixed in 3.2.1 Patch available CNA
Remediation
Update Fraunhofer HHI VVdeC to version 3.2.1 or later. The sources list no advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA vvdec (fraunhoferhhi) Fixed in 3.2.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
fraunhoferhhi vvdec 3.2.1
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2026-86610 Out-of-bounds read in Fraunhofer HHI VVdeC decoderPriority MEDIUM 46
- TI-2026-86609 Heap out-of-bounds read in Fraunhofer HHI VVdeC SEI parsingPriority MEDIUM 46
- TI-2026-86607 Use-after-free in Fraunhofer HHI VVdeC via ALF APS redefinitionPriority MEDIUM 41
Timeline
- 2026-11-07 Threatist record created from CVE-2026-124308
- 2026-11-07 Alias added: GHSA-g75c-jvvc-4qf4
References
Other 5
- https://github.com/fraunhoferhhi/vvdec/issues/403
- https://github.com/fraunhoferhhi/vvdec/issues/392
- https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/DecoderLib/DecLibRecon.cpp#L405-L420
- https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/DecoderLib/DecLibRecon.cpp#L538-L542
- https://github.com/fraunhoferhhi/vvdec
More fraunhoferhhi vulnerabilities
- TI-2026-86610 Out-of-bounds read in Fraunhofer HHI VVdeC decoder CVSS 4.0MEDIUM 6.9
- TI-2026-86609 Heap out-of-bounds read in Fraunhofer HHI VVdeC SEI parsing CVSS 4.0MEDIUM 6.9
- TI-2026-86611 VVdeC NULL Pointer Dereference via InterPrediction::xPredInterBlk CVSS 4.0MEDIUM 6.8
- TI-2026-86612 Heap out-of-bounds read in Fraunhofer HHI VVdeC decoder CVSS 4.0MEDIUM 5.7
- TI-2026-86607 Use-after-free in Fraunhofer HHI VVdeC via ALF APS redefinition CVSS 4.0MEDIUM 5.8
Sources
- CVE-2026-124308 · CVE Program
- CVE-2026-124308 · NVD
- GHSA-g75c-jvvc-4qf4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences