Systems that use vvdecapp or an application built with the VVdeC library to process attacker-controlled VVC bitstreams are exposed. The reported impact is a crash and denial of service.
An attacker needs a crafted VVC bitstream that redefines an ALF APS identifier while a decoder worker is still using the previous APS. Reproduction is timing-dependent and uses multithreaded decoding; the CVSS vector also indicates user interaction is required.
The advisory identifies versions before 3.2.1 as affected. It also identifies commit 1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01 as the fix.
No. The issue is a heap use-after-free memory-safety violation, but arbitrary code execution was not demonstrated; the stated impact is denial of service through a crash.