CVE-2026-124308: Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs

Published Nov 7, 2026

Updated

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:17 PM

Data Sourced

via MITRE·02:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to exploitation?

VVdeC versions before 3.2.1 are affected when they decode attacker-controlled multi-subpicture VVC bitstreams using two or more threads. The issue can cause heap memory corruption or a decoder crash.

What must an attacker provide to trigger the flaw?

An attacker needs to supply a crafted VVC bitstream containing multiple subpictures to a vulnerable decoder. Exploitation depends on the decoder operating with at least two threads.

Are single-threaded decoding configurations affected?

The described race condition requires two or more threads, so the provided information identifies multithreaded decoding as the affected configuration. No impact for single-threaded decoding is stated.

CVE-2026-124308: Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs

Event History

Frequently Asked Questions

Which deployments are exposed to exploitation?

What must an attacker provide to trigger the flaw?

Are single-threaded decoding configurations affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to exploitation?

What must an attacker provide to trigger the flaw?

Are single-threaded decoding configurations affected?