VVdeC versions before 3.2.1 are affected. The issue can affect vvdecapp and applications that use the VVdeC library when they process attacker-controlled VVC bitstreams.
An attacker must cause the target to process a crafted multi-subpicture VVC bitstream. The bitstream needs to abort picture decoding while border-extension tasks are still pending, followed by another picture that can invalidate parameters retained by worker threads.
The supplied CVSS vector lists local attack vector and user interaction required. The report describes exploitation through processing an attacker-controlled bitstream, but does not establish remote delivery or arbitrary code execution.
Check whether the deployed VVdeC version is earlier than 3.2.1 and whether it processes untrusted VVC content. The reported failure is intermittent: it was reproduced in 5 of 20 ASan runs with -t 1, so absence of a crash does not rule out exposure.
Update to a version containing the fix. The upstream fix makes SubPicExtTask parameters belong to the Picture so they remain valid after reconstruction finishes.