# CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs during Subpicture Reconstruction

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/678) · 2026-11-11 · Security
Page: https://themorning.dev/story/cve-2026-124308-vvdec-vvdecapp-heap-use-after-free-in-declibrecon-createsubpicre-d56fdbd2f8f7c324
Kind: security · Impact: medium

## In brief

- CVE-2026-124308 is a heap use-after-free (CWE-416) in DecLibRecon::createSubPicRefBufs during subpicture reconstruction in VVdeC/vvdecapp.
- Affected versions are those before 3.2.1; the issue was reproduced on build 3.3.0-dev.
- A fix is available in commit 8a0def8ba6050412d33e69a6f1e66e287b039083.

## Why it matters

Developers who build or run VVdeC/vvdecapp older than 3.2.1 are exposed to a memory-safety bug that can corrupt or crash the decoder when subpictures are reconstructed.

## What to do

- Upgrade VVdeC/vvdecapp to 3.2.1 or later, which includes the fix commit 8a0def8ba6050412d33e69a6f1e66e287b039083.

## Versions

- VVdeC 3.2.1
- VVdeC 3.3.0-dev

## CVEs

- CVE-2026-124308

## Timeline

- 2026-11-11: Vulnerability disclosed on the oss-security mailing list by Alexander A. Shvedov

## Coverage

- [CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs during Subpicture Reconstruction](https://seclists.org/oss-sec/2026/q4/678) — Open Source Security, 2026-11-11

Tags: security, vvdec, use-after-free, video-codec, vvc, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev