CVE-2026-124307— Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition

Quick assessment

Affected

fraunhoferhhi vvdec

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fraunhofer HHI VVdeC 在 3.2.1 版本之前存在堆释放后使用（heap use-after-free）漏洞。攻击者可通过重新定义仍被切片引用的 ALF（自适应环路滤波）参数集 ID，从而破坏内存。攻击者可提供精心构造的 VVC 比特流，在多线程解码场景下，诱导工作线程在和函数中解引用已被释放的 APS（参数集）对象，进而导致程序崩溃或堆内存损坏。

CVSS 5.8 · Medium Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition

Source: CVE Program / CVE List V5

Vulnerability Description

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
fraunhoferhhi	vvdec	0 ~ 3.2.1	-

II. Public POCs for CVE-2026-124307

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124307

请登录查看更多情报信息。

Other References for CVE-2026-124307 (8)

https://github.com/fraunhoferhhi/vvdec/issues/390 issue-tracking
https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/Slice.h#L2570 technical-description
https://github.com/fraunhoferhhi/vvdec/commit/1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01 patch
https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/DecoderLib/CABACReader.cpp#L428-L429 technical-description
https://github.com/fraunhoferhhi/vvdec product
https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/ParameterSetManager.h#L97 technical-description
https://github.com/fraunhoferhhi/vvdec/issues/391 issue-tracking
https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-heap-use-after-free-via-alf-aps-redefinition third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124307

Same Patch Batch · fraunhoferhhi · 2026-11-07 · 6 CVEs total

CVE-2026-124310	6.1 MEDIUM	Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic
CVE-2026-124309	6.1 MEDIUM	Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalable
CVE-2026-124308	5.8 MEDIUM	Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs
CVE-2026-124311	5.5 MEDIUM	Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInte
CVE-2026-124312	4.7 MEDIUM	Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo

IV. Related Vulnerabilities

Same product: vvdec

Same vendor: fraunhoferhhi

Same weakness: CWE-416