Out-of-Bounds Read Vulnerability in Fraunhofer HHI VVdeC Decoder

CVE-2026-124310

What is CVE-2026-124310?

The VVdeC Decoder from Fraunhofer HHI has a vulnerability that enables attackers to exploit an out-of-bounds read condition. By using specially crafted bitstreams with overlapping slice CTU coverage, an attacker can craft a CTU in a second slice. This allows a bi-predicted BDOF coding unit to utilize a negative reference index, leading to a crash during the decoding process as Slice::getRefPic attempts to access memory outside of the m_apcRefPicList.

References