CVE-2026-124310

MEDIUM 6.1

Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index, causing Slice::getRefPic to read outside m_apcRefPicList and crash decoding.

CWE	CWE-129
Vendor	fraunhoferhhi
Product	vvdec
Published	Nov 7, 2026

Stay Ahead of the Next One

Get instant alerts for fraunhoferhhi vvdec

Be the first to know when new medium vulnerabilities affecting fraunhoferhhi vvdec are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

fraunhoferhhi / vvdec

0 < 3.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/fraunhoferhhi/vvdec/issues/402 github.com: https://github.com/fraunhoferhhi/vvdec/commit/6e4b907ef5ab9db390b1293ba1ad5d7dd0a67e3f github.com: https://github.com/fraunhoferhhi/vvdec/commit/32b842c10bf024f09bc7cf1445fa6f8a987422ca github.com: https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/InterPrediction.cpp#L609-L631 github.com: https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/Slice.h#L2645 github.com: https://github.com/fraunhoferhhi/vvdec vulncheck.com: https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-out-of-bounds-read-via-slice-getrefpic

Credits

Alexander A. Shvedov (sigdevel)