EUVD-2026-119278

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-124308

Fraunhofer HHI VVdeC versions prior to 3.2.1 are vulnerable to a heap use-after-free vulnerability within the DecLibRecon::createSubPicRefBufs function. The root cause is that the decompressPicture function clears m_subPicExtTasks without waiting for tasks that are still pending. An attacker can ...