Heap Out-of-Bounds Read in Fraunhofer HHI VVdeC Product

CVE-2026-124309

What is CVE-2026-124309?

The Fraunhofer HHI VVdeC is vulnerable to a heap out-of-bounds read due to improper handling in the SEIReader::xParseSEIScalableNesting function. Attackers can exploit this vulnerability by crafting a VVC bitstream that contains a scalable nesting SEI with nested buffering periods. This could potentially allow unauthorized access to adjacent heap memory, leading to decoder crashes or information leaks.

References