Heap Use-After-Free Vulnerability in Fraunhofer HHI VVdeC Product

CVE-2026-124308

What is CVE-2026-124308?

The Fraunhofer HHI VVdeC product, prior to version 3.2.1, is affected by a heap use-after-free vulnerability in the DecLibRecon::createSubPicRefBufs function. This issue arises when the decompressPicture method clears the m_subPicExtTasks variable without waiting for any pending tasks to complete. An attacker can exploit this vulnerability by supplying a specially crafted multi-subpicture VVC bitstream to decoders that are operated using multiple threads. This exploitation can result in heap memory corruption and may lead to a crash of the decoder, compromising its functionality.

References