Cyber ·
CVE-2026-124308: use-after-free in VVdeC/vvdecapp before 3.2.1
Heap use-after-free in subfigure reconstruction in VVdeC/vvdecapp versions before 3.2.1. CVSS 3.1 score of 5.8, medium severity, with a fix identified by commit.
Published on the oss-sec feed on November 11, 2026, the advisory describes CVE-2026-124308, classified as CWE-416 (use after free). The flaw is in subfigure reconstruction in VVdeC (vvdecapp), a VVC video decoding library, in versions before 3.2.1. According to the text, subfigure edge extension tasks keep raw pointers, which can lead to use of already freed memory. The reproduced build was 3.3.0-dev, at commit e493ce51f13a2dea72cd58354652ed4e0f509a0e, and the fix appears in commit 8a0def8ba6050412d33e69a6f1e66e287b039083. The CVSS 3.1 score is 5.8 (medium), with vector AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H, indicating local access, high complexity, user interaction and mainly availability impact.
For teams operating VVdeC, the practical step is to check whether the version in use is earlier than 3.2.1 and update to the fixed or a later version, confirming the fix in the upstream project history. Rota Nacional does not provide or patch this library, and this advisory does not indicate any platform capability that resolves the flaw. Read the original text on the oss-sec feed dated November 11, 2026 for further details before acting.