CVE-2026-124312
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-125
Lectura fuera de límites
Fecha de publicación:
07/11/2026
Última modificación:
09/11/2026
Descripción
*** Pendiente de traducción *** Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColInfo to read past the colMotion allocation when error concealment is enabled.
Impacto
Puntuación base 4.0
5.70
Gravedad 4.0
MEDIA
Puntuación base 3.x
4.70
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/fraunhoferhhi/vvdec
- https://github.com/fraunhoferhhi/vvdec/blob/v3.2.1/source/Lib/CommonLib/CodingStructure.cpp#L453-L458
- https://github.com/fraunhoferhhi/vvdec/blob/v3.2.1/source/Lib/CommonLib/Slice.cpp#L1819-L1859
- https://github.com/fraunhoferhhi/vvdec/commit/0695c06221c27b3680fec9851ac2cf46b2195ea9
- https://github.com/fraunhoferhhi/vvdec/issues/422
- https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-through-3.2.1-heap-out-of-bounds-read-via-codingstructure-getcolinfo
- https://github.com/fraunhoferhhi/vvdec/issues/422