VVdeC/vvdecapp: Heap Out-of-Bounds Read in CodingStructure::getColInfo
A heap out-of-bounds read vulnerability in the CodingStructure::getColInfo function of the VVdeC library may occur when processing a crafted VVC bitstream with a smaller collocated picture.
CVE search metadata
CVE search record: CVE-2026-124312. Severity: medium. CVSS: 4.7. EPSS: 0.12%. KEV: no. Brief: VVdeC/vvdecapp: Heap Out-of-Bounds Read in CodingStructure::getColInfo. Brief link: https://feed.craftedsignal.io/briefs/2026-11-vvdec-oob-read-cve-2026-124312/
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 17:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
A heap out-of-bounds read vulnerability has been identified in the CodingStructure::getColInfo function of the VVdeC library (vvdecapp). The vulnerability is triggered by a crafted VVC bitstream that utilizes a smaller-than-expected collocated picture.
Impact
This vulnerability is associated with CWE-125 (Out-of-bounds Read) and carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H), indicating a potential for denial-of-service.
Recommendation
Users of the affected software should monitor for updates from the official project maintainers to address this vulnerability.