Product: VVdeC (vvdecapp) Affected: Versions before 3.2.1 Reproduced build: 3.3.0-dev Commit e2a596a6524b84d89233d2644896c4d4086ee78f Fixed: 8a0def8ba6050412d33e69a6f1e66e287b039083 CVE: CVE-2026-124308 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.8 MEDIUM (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H) Reporter: Alexander A. Shvedov (@sigdevel)

Description: This report continues local bug 3 (upstream issue #392) after the initial PR #393 change. A crafted multi-subpicture VVC bitstream aborts picture decoding while border-extension tasks remain pending. Starting another picture can invalidate the task parameters retained by worker threads.

The local description reports an intermittent createSubPicRefBufs() use- after-free, reproduced in 5 of 20 ASan runs with -t 1. The upstream fix in PR #404 attaches SubPicExtTask parameters to the Picture so that they remain alive after reconstruction finishes. Both reports are covered by CVE-2026-124308.

Impact: Processing an attacker-controlled VVC bitstream can crash vvdecapp or an application using the VVdeC library, causing denial of service. The use- after-free is a memory-safety violation; arbitrary code execution was not demonstrated in the supplied evidence.

Reproduction: Build VVdeC with AddressSanitizer (VVDECUSEADDRESSSANITIZER=ON, VVDECFUZZINGBUILD=ON), then run with the linked sample:

./vvdecapp -b ./11createSubPicRefBufsDecoderLibDecLibReconcpp409 -t 1

Evidence note: The supplied asan.log and Markdown stack trace show Picture::isRefScaled() at CommonLib/Picture.h:267, rather than createSubPicRefBufs(). They therefore do not corroborate the reported use-after-free read site. The description and CVE mapping above follow the local report and upstream issue/fix references; a matching ASan trace is needed before quoting a createSubPicRefBufs() crash for this sample.

Fix: Update to VVdeC 3.2.1 or apply the upstream fix referenced below. For the subpicture task lifetime issue, use the final task-ownership fix rather than relying on the initial PR #393 change.

https://github.com/fraunhoferhhi/vvdec/releases/tag/v3.2.1

https://github.com/fraunhoferhhi/vvdec/commit/8a0def8ba6050412d33e69a6f1e66e287b039083

PoC: https://github.com/sigdevel/pocs/blob/main/res/vvdec/vvdecapp/11/11createSubPicRefBufsDecoderLibDecLibReconcpp409

References: https://github.com/fraunhoferhhi/vvdec/issues/403 https://github.com/fraunhoferhhi/vvdec/issues/392 https://github.com/fraunhoferhhi/vvdec/commit/8a0def8ba6050412d33e69a6f1e66e287b039083 https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-use-after-free-via-declibrecon-createsubpicrefbufs https://www.cve.org/CVERecord?id=CVE-2026-124308 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124308.json

—— Best regards, Alexander A. Shvedov @sigdevel

Product: VVdeC (vvdecapp) Affected: Versions through 3.2.1 Reproduced build: 3.3.0-dev Commit 76f087e5936336b951801576514c0fd42976b7eb Fixed: fb73aca37b48f89814f57edbc8072a37d47bbe06 CVE: CVE-2026-124311 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel)

Description: A crafted VVC bitstream switches to an SPS with reference wrap-around enabled while retaining the picture dimensions. Reference pictures decoded under the previous SPS can lack the wrap-around reconstruction buffer. Inter prediction selects that missing buffer based on the new SPS flag and reads reference samples through a NULL pointer.

The report identifies InterPrediction::xPredInterBlk() at CommonLib/InterPrediction.cpp:796; the supplied optimized ASan trace reaches the same prediction path at line 830 via an interpolation/copy operation. The observed fault is a read at address 0x20, and the crash is reported as deterministic.

Impact: Processing an attacker-controlled VVC bitstream can crash vvdecapp or an application using the VVdeC library, causing denial of service. The observed fault is a near-NULL read.

Reproduction: Build VVdeC with AddressSanitizer (VVDECUSEADDRESSSANITIZER=ON, VVDECFUZZINGBUILD=ON), then run with the linked sample:

./vvdecapp -b ./8xPredInterBlkCommonLibInterPredictioncpp796 --y4m -o /dev/null -t 1 -v 0

ASan log excerpt (abbreviated): ==224669==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 ==224669==The signal is caused by a READ memory access. ==224669==Hint: address points to the zero page. #0 in asanmemcpy #1 in void vvdec::copyBufferSSE< CommonLib/x86/avx2/../BufferX86.h:596:5 #2 in vvdec::InterpolationFilter::filterHor CommonLib/InterpolationFilter.cpp:1062:7

Fix: Apply the upstream fix below. Version 3.2.1 is still affected according to the published CVE record.

https://github.com/fraunhoferhhi/vvdec/commit/fb73aca37b48f89814f57edbc8072a37d47bbe06

PoC: https://github.com/sigdevel/pocs/blob/main/res/vvdec/vvdecapp/8/8xPredInterBlkCommonLibInterPredictioncpp796

References: https://github.com/fraunhoferhhi/vvdec/issues/420 https://github.com/fraunhoferhhi/vvdec/commit/fb73aca37b48f89814f57edbc8072a37d47bbe06 https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-through-3.2.1-null-pointer-dereference-via-interprediction-xpredinterblk https://www.cve.org/CVERecord?id=CVE-2026-124311 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124311.json

—— Best regards, Alexander A. Shvedov @sigdevel

Product: VVdeC (vvdecapp) Affected: Versions before 3.2.1 Reproduced build: 3.3.0-dev Commit e493ce51f13a2dea72cd58354652ed4e0f509a0e Fixed: 1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01 CVE: CVE-2026-124307 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.8 MEDIUM (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H) Reporter: Alexander A. Shvedov (@sigdevel)

Description: A crafted VVC bitstream can redefine an ALF adaptation parameter set (APS) id while a decoder worker still uses the previous APS. ParameterSetMap::storePS() replaces the owning sharedptr and frees the old object. AdaptiveLoopFilter::reconstructCoeff() then reads the freed APS while rebuilding filter coefficients at CommonLib/AdaptiveLoopFilter.cpp:894. The reported allocation is 8040 bytes.

This is the same APS lifetime defect as the CABACReader::readAlf() read site in local bug 2 (upstream issue #391), covered by the same CVE. Reproduction is timing-dependent and uses multithreaded decoding.

Impact: Processing an attacker-controlled VVC bitstream can crash vvdecapp or an application using the VVdeC library, causing denial of service. The use- after-free is a memory-safety violation; arbitrary code execution was not demonstrated in the supplied evidence.

Reproduction: Build VVdeC with AddressSanitizer (VVDECUSEADDRESSSANITIZER=ON, VVDECFUZZINGBUILD=ON), then run with the linked sample:

./vvdecapp -b ./1reconstructCoeffCommonLibAdaptiveLoopFiltercpp894 -t 3

ASan log excerpt (abbreviated): ==504830==ERROR: AddressSanitizer: heap-use-after-free on address 0x7e03437e7f6d READ of size 1 at 0x7e03437e7f6d thread T3 #0 in vvdec::AdaptiveLoopFilter::reconstructCoeff CommonLib/AdaptiveLoopFilter.cpp:894:42 #1 in vvdec::AdaptiveLoopFilter::reconstructCoeffAPSs CommonLib/AdaptiveLoopFilter.cpp:870:7 #2 in vvdec::DecSlice::parseSlice DecoderLib/DecSlice.cpp:88:3

Fix: Update to VVdeC 3.2.1 or apply the upstream fix referenced below.

https://github.com/fraunhoferhhi/vvdec/releases/tag/v3.2.1

https://github.com/fraunhoferhhi/vvdec/commit/1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01

PoC: https://github.com/sigdevel/pocs/blob/main/res/vvdec/vvdecapp/1/1reconstructCoeffCommonLibAdaptiveLoopFiltercpp894

References: https://github.com/fraunhoferhhi/vvdec/issues/391 https://github.com/fraunhoferhhi/vvdec/issues/390 https://github.com/fraunhoferhhi/vvdec/commit/1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01 https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-heap-use-after-free-via-alf-aps-redefinition https://www.cve.org/CVERecord?id=CVE-2026-124307 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124307.json

—— Best regards, Alexander A. Shvedov @sigdevel

Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with spsrefwraparoundenabledflag set, causing reads from missing PICRECONWRAP buffers and denial of service.

Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColInfo to read past the colMotion allocation when error concealment is enabled.

Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index, causing Slice::getRefPic to read outside mapcRefPicList and crash decoding.

Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI to crash the decoder or copy adjacent heap memory.

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption.

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash.