{"id":"CVE-2026-124311","published":"2026-11-07T15:17:14.983","lastModified":"2026-11-09T23:17:19.260","description":"Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with sps_ref_wraparound_enabled_flag set, causing reads from missing PIC_RECON_WRAP buffers and denial of service.","cvssScore":5.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwes":["CWE-476"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fraunhoferhhi/vvdec","tags":[]},{"url":"https://github.com/fraunhoferhhi/vvdec/blob/v3.2.1/source/Lib/CommonLib/InterPrediction.cpp#L790-L796","tags":[]},{"url":"https://github.com/fraunhoferhhi/vvdec/commit/fb73aca37b48f89814f57edbc8072a37d47bbe06","tags":[]},{"url":"https://github.com/fraunhoferhhi/vvdec/issues/420","tags":[]},{"url":"https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-through-3.2.1-null-pointer-dereference-via-interprediction-xpredinterblk","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/22","tags":[]}],"exploitRefs":[{"url":"https://github.com/fraunhoferhhi/vvdec","tags":[]},{"url":"https://github.com/fraunhoferhhi/vvdec/blob/v3.2.1/source/Lib/CommonLib/InterPrediction.cpp#L790-L796","tags":[]},{"url":"https://github.com/fraunhoferhhi/vvdec/commit/fb73aca37b48f89814f57edbc8072a37d47bbe06","tags":[]},{"url":"https://github.com/fraunhoferhhi/vvdec/issues/420","tags":[]}],"hasPoc":true,"ai":null}