VVdeC: Heap use-after-free in AdaptiveLoopFilter (CVE-2026-124307)
A heap use-after-free vulnerability in the VVdeC decoder (vvdecapp) occurs in AdaptiveLoopFilter::reconstructCoeff due to ALF APS redefinition.
CVE search metadata
CVE search record: CVE-2026-124307. Severity: medium. CVSS: 5.8. EPSS: 0.11%. KEV: no. Product: VVdeC (vvdecapp) versions before 3.2.1. Brief: VVdeC: Heap use-after-free in AdaptiveLoopFilter (CVE-2026-124307). Brief link: https://feed.craftedsignal.io/briefs/2026-11-vvdec-uaf/
Triage facts
Revision 1- Applicability
- VVdeC (vvdecapp) versions before 3.2.1
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 23:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
A heap use-after-free vulnerability (CWE-416) has been identified in VVdeC (vvdecapp) within the AdaptiveLoopFilter::reconstructCoeff function, triggered by a crafted VVC bitstream that performs an ALF (Adaptive Loop Filter) APS (Adaptation Parameter Set) redefinition.
Affected versions include versions before 3.2.1. The issue was fixed in commit 1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01.