CVE-2026-124307

Fraunhofer HHI VVdeC versions before 3.2.1 are vulnerable to a heap use-after-free flaw. The root cause occurs when an attacker provides a crafted VVC bitstream that redefines an ALF adaptation parameter set (APS) ID while it is still being referenced by slices. During multithreaded decoding, wor...

EUVD-2026-119279

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads...