vvdecapp and applications using the VVdeC library are exposed when they process an attacker-controlled VVC bitstream. The CVSS vector indicates local attack access and user interaction are required.
The bitstream must switch to an SPS that enables reference wrap-around while retaining the picture dimensions. Reference pictures decoded under the earlier SPS may not have a wrap-around reconstruction buffer, but inter prediction selects that missing buffer under the new SPS.
Versions through 3.2.1 are identified as affected. The issue was also reproduced in a 3.3.0-dev build at commit 76f087e5936336b951801576514c0fd42976b7eb, and the report identifies commit fb73aca37b48f89814f57edbc8072a37d47bbe06 as the fix.
The reported failure is deterministic and manifests as a near-NULL read at address 0x20. The crash path reaches InterPrediction::xPredInterBlk() in CommonLib/InterPrediction.cpp through an interpolation or copy operation.
Processing the crafted stream can crash vvdecapp or an application using VVdeC, resulting in denial of service. The provided CVSS assessment rates availability impact as high, with no confidentiality or integrity impact.