CVE-2026-124312

Fraunhofer HHI VVdeC versions through 3.2.1 are affected by a heap out-of-bounds read vulnerability in the CodingStructure::getColInfo function. An attacker can crash the decoder by providing a specially crafted VVC bitstream that enables TMVP with a smaller collocated reference picture. This cau...

CVE-2026-124311

The Fraunhofer HHI VVdeC decoder (versions through 3.2.1 ) contains a NULL pointer dereference vulnerability within the InterPrediction::xPredInterBlk function. An attacker can trigger a denial of service (crash) by providing a crafted VVC bitstream that switches the Sequence Parameter Set (SPS) ...

CVE-2026-124309

Fraunhofer HHI VVdeC versions before 3.2.1 are vulnerable to a heap out-of-bounds read in the SEIReader::xParseSEIScalableNesting function. The vulnerability occurs because the software casts the SEI wrapper object instead of its intended payload. An attacker can exploit this by providing a craft...