CVE-2026-124307mediumCWE-416

CVE-2026-124307: falha de média gravidade em fraunhoferhhi vvdec

Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition

Publicada em

Seguir esta CVE+ Monitorar vvdec

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

10Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.8
Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption.
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
fraunhoferhhi · vvdec
CVEs relacionadas — fraunhoferhhi vvdec

No mesmo produto, das mais perigosas para as menos.

CVE-2026-124312MEDIUMFraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfoEPSS —CVE-2026-124311MEDIUMFraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlkEPSS —CVE-2026-124310MEDIUMFraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPicEPSS —CVE-2026-124309MEDIUMFraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNestingEPSS —CVE-2026-124308MEDIUMFraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufsEPSS —