CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs during Subpicture Reconstruction

The Brief

CVE-2026-124308 is a heap use-after-free (CWE-416) in DecLibRecon::createSubPicRefBufs during subpicture reconstruction in VVdeC/vvdecapp.
Affected versions are those before 3.2.1; the issue was reproduced on build 3.3.0-dev.
A fix is available in commit 8a0def8ba6050412d33e69a6f1e66e287b039083.

Why it matters

Developers who build or run VVdeC/vvdecapp older than 3.2.1 are exposed to a memory-safety bug that can corrupt or crash the decoder when subpictures are reconstructed.

Who’s affected

VVdeC and vvdecapp users running versions before 3.2.1

What to do

Upgrade VVdeC/vvdecapp to 3.2.1 or later, which includes the fix commit 8a0def8ba6050412d33e69a6f1e66e287b039083.

VVdeC 3.2.1
VVdeC 3.3.0-dev
CVE-2026-124308
#security
#vvdec
#use-after-free
#video-codec
#vvc
#cve

Posted by Alexander A. Shvedov on Nov 11 Product: VVdeC (vvdecapp) Affected: Versions before 3.2.1 Reproduced build: 3.3.0-dev Commit e493ce51f13a2dea72cd58354652ed4e0f509a0e Fixed: 8a0def8ba6050412d33e69a6f1e66e287b039083 CVE: CVE-2026-124308 CWE: CWE-416 (Use After Free) CVSS…

Read the full story at seclists.org ↗

Timeline

Nov 11
Vulnerability disclosed on the oss-security mailing list by Alexander A. Shvedov
Nov 11 · 9:21 PM
Open Source Security
CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs during Subpicture Reconstruction