Vulnerability · medium · CVSS 5.8
VVdeC CVE-2026-124308: heap use-after-free in subpicture reconstruction
Tier B · Patch this week – Put it in the sprint
Who’s exposed: VVdeC and vvdecapp users on versions before 3.2.1
Tier B because: Exploited in the wild OR public exploit
Reach
Attack
Damage
Fix
Public exploit
What to do
- Upgrade VVdeC/vvdecapp to 3.2.1 or later, which includes the fix commit 8a0def8ba6050412d33e69a6f1e66e287b039083.
The Brief
- CVE-2026-124308 is a heap use-after-free (CWE-416) in DecLibRecon::createSubPicRefBufs during subpicture reconstruction in VVdeC/vvdecapp.
- Affected versions are those before 3.2.1; the issue was reproduced on build 3.3.0-dev.
- A fix is available in commit 8a0def8ba6050412d33e69a6f1e66e287b039083.
Why it matters
Developers who build or run VVdeC/vvdecapp older than 3.2.1 are exposed to a memory-safety bug that can corrupt or crash the decoder when subpictures are reconstructed.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | VVdeC is an open-source VVC video decoder library that developers and integrators build into their software. |
| No | Core infrastructure | VVdeC is a specialized video codec decoder, not software nearly every team runs. |
| No | Popular tool | VVdeC is a niche codec library with limited adoption compared with mainstream frameworks or platforms. |
| No | Exploited in the wild | Open Source Security (2026-11-11) describes a discovered bug with no mention of observed attacks or KEV listing. |
| Yes | Public exploit | CISA SSVCCISA rates exploitation of CVE-2026-124308 as proof of concept public |
| No | Remote, no login | CVSSCVSS: CVE-2026-124308 AV:L/PR:N/UI:P |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | Open Source Security post describes a memory-safety bug in subpicture reconstruction with no data theft reported. |
| No | Supply chain | Open Source Security post describes a vulnerability in VVdeC code, not a compromised package or build pipeline. |
| No | No fix yet | Open Source Security post lists a fixed commit and says affected versions are those before 3.2.1, so a fix exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-124308 ↗CVSS 5.8 medium AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs
- Exploited
- Proof of concept public (CISA)
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 1.3% of all CVEs
- Weakness
- CWE-416
Timeline
Vulnerability disclosed on the oss-security mailing list by Alexander A. Shvedov
Open Source Security
CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs during Subpicture Reconstruction
Source
CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs during Subpicture Reconstruction ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided