Heap Use-After-Free Vulnerability in Fraunhofer HHI VVdeC Product
CVE-2026-124307
5.8MEDIUM
What is CVE-2026-124307?
The Fraunhofer HHI VVdeC product prior to version 3.2.1 has a serious heap use-after-free vulnerability. This flaw allows malicious actors to exploit the system by redefining an adaptation parameter set ID while slices still reference it. By introducing a specially crafted VVC bitstream during multithreaded decoding, attackers can trigger worker threads to dereference freed Adaptation Parameter Set (APS) objects within specific decoding functions, such as CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(). This exploitation can lead to application crashes or corruption of heap memory, posing significant risks to system integrity.
Affected Version(s)
vvdec 0 < 3.2.1
vvdec 3.2.1