{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vvdec-vvdecapp-versions-before-3.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":5.8,"id":"CVE-2026-124307"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VVdeC (vvdecapp) versions before 3.2.1"],"_cs_severities":["low"],"_cs_tags":["vulnerability","memory-corruption"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA heap use-after-free vulnerability (CWE-416) has been identified in VVdeC (vvdecapp) within the \u003ccode\u003eAdaptiveLoopFilter::reconstructCoeff\u003c/code\u003e function, triggered by a crafted VVC bitstream that performs an ALF (Adaptive Loop Filter) APS (Adaptation Parameter Set) redefinition.\u003c/p\u003e\n\u003cp\u003eAffected versions include versions before 3.2.1. The issue was fixed in commit 1eddb30c4b8e02f3d13ba24aa7e52f1aa7b08c01.\u003c/p\u003e\n","date_modified":"2026-11-09T23:17:40Z","date_published":"2026-11-09T23:17:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-vvdec-uaf/","summary":"A heap use-after-free vulnerability in the VVdeC decoder (vvdecapp) occurs in AdaptiveLoopFilter::reconstructCoeff due to ALF APS redefinition.","title":"VVdeC: Heap use-after-free in AdaptiveLoopFilter (CVE-2026-124307)","url":"https://feed.craftedsignal.io/briefs/2026-11-vvdec-uaf/"}],"language":"en","title":"CraftedSignal Threat Feed - VVdeC (Vvdecapp) Versions Before 3.2.1","version":"https://jsonfeed.org/version/1.1"}