CVE-2026-124309

Medium

Description

Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI to crash the decoder or copy adjacent heap memory.

SeverityMedium

CVSS6.1

Exploit probability—

ProductFraunhoferhhi Vvdec

PublishedNov 7, 2026

First seenNov 7, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Update

fraunhoferhhi vvdec3.2.1 or later

Patches

github.com/fraunhoferhhi/vvdec/commit/1d657c7a822987d2ff935e9c227c5faf5318ca06

Affected products

Product	Affected versions	Fixed in
fraunhoferhhi vvdec	v < 3.2.1	3.2.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.