CVE-2026-124310— Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic

Quick assessment

Affected

fraunhoferhhi vvdec

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fraunhofer HHI VVdeC 在 3.2.1 版本之前存在一个越界读取漏洞。攻击者可以通过提供具有重叠片（slice）CTU 覆盖范围的比特流，使解码器崩溃。具体而言，攻击者可在第二个片中对 CTU 进行编码，使得双向预测的 BDOF 编码单元携带负的参考索引，从而导致函数在读取时发生越界访问，最终引发解码过程崩溃。

CVSS 6.1 · Medium Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic

Source: CVE Program / CVE List V5

Vulnerability Description

Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index, causing Slice::getRefPic to read outside m_apcRefPicList and crash decoding.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对数组索引的验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
fraunhoferhhi	vvdec	0 ~ 3.2.1	-

II. Public POCs for CVE-2026-124310

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124310

请登录查看更多情报信息。

Other References for CVE-2026-124310 (7)

https://github.com/fraunhoferhhi/vvdec/commit/6e4b907ef5ab9db390b1293ba1ad5d7dd0a67e3f patch
https://github.com/fraunhoferhhi/vvdec/issues/402 issue-tracking
https://github.com/fraunhoferhhi/vvdec product
https://github.com/fraunhoferhhi/vvdec/commit/32b842c10bf024f09bc7cf1445fa6f8a987422ca patch
https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/Slice.h#L2645 technical-description
https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/InterPrediction.cpp#L609-L631 technical-description
https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-out-of-bounds-read-via-slice-getrefpic third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124310

Same Patch Batch · fraunhoferhhi · 2026-11-07 · 6 CVEs total

CVE-2026-124309	6.1 MEDIUM	Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalable
CVE-2026-124308	5.8 MEDIUM	Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs
CVE-2026-124307	5.8 MEDIUM	Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition
CVE-2026-124311	5.5 MEDIUM	Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInte
CVE-2026-124312	4.7 MEDIUM	Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo

IV. Related Vulnerabilities

Same product: vvdec

Same vendor: fraunhoferhhi

Same weakness: CWE-129