Heap Out-of-Bounds Read Vulnerability in Fraunhofer HHI VVdeC Product

CVE-2026-124312

What is CVE-2026-124312?

The VVdeC product by Fraunhofer HHI up to version 3.2.1 is exposed to a heap out-of-bounds read vulnerability. Attackers can exploit this flaw by crafting a VVC bitstream that utilizes the Temporal Motion Vector Prediction (TMVP) with a collocated reference picture of a different resolution. When error concealment is enabled, the getColInfo function may attempt to read beyond the allocated memory for colMotion, potentially causing the decoder to crash. Users of this product are advised to review the recent patches and update to secure their systems from exploitation.

References