CVE-2026-124312

Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo

5.7 Medium

Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColInfo to read past the colMotion allocation when error concealment is enabled.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

What each source reports

CVE List Score used 5.7

Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo

Record: CVE-2026-124312
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-07

EUVDEUVD-2026-119274 5.7

Record: EUVD-2026-119274
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-07

GitHub AdvisoriesGHSA-fcm3-84wv-3v4w 5.7

Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows...

Record: GHSA-fcm3-84wv-3v4w
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-07

NVD 5.7

Record: CVE-2026-124312
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-07

Affected products

fraunhoferhhi vvdec

History

History
Recorded	Changed	Sources
Nov 7, 2026	published	EUVD, NVD
Nov 7, 2026	published	EUVD
Nov 7, 2026	aliases, references	GitHub Advisories
Nov 7, 2026	cwes, references, severity, title	CVE List
Nov 7, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-124312 is a medium vulnerability (CVSS 5.7) in Fraunhoferhhi Vvdec, published November 7, 2026. No source lists public exploit code. No source names a fixed version.