Cyber ·
CVE-2026-124309: heap out-of-bounds read in HRD::setBufferingPeriodSEI in VVdeC
Out-of-bounds heap read in VVdeC (vvdecapp) when parsing scalable nesting SEI messages. Fixed in version 3.2.1, rated medium severity (CVSS 3.1: 6.1).
Advisory CVE-2026-124309 describes an out-of-bounds read on the heap that can occur in HRD::setBufferingPeriodSEI in VVdeC (vvdecapp) when parsing a scalable nesting SEI message. The weakness is classified as CWE-125 (out-of-bounds read). Affected products are versions before 3.2.1. The issue was reproduced on build 3.3.0-dev, commit e493ce51f13a2dea72cd58354652ed4e0f509a0e. The fix is commit 1d657c7a822987d2ff935e9c227c5faf5318ca06. The CVSS 3.1 score is 6.1, medium, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H. Under that vector the attack is local and requires user interaction, with no confidentiality or integrity impact and high availability impact. The advisory was posted to the oss-sec list on 11 November 2026. The available text is an automatic translation of the feed, and the description is truncated. To confirm details, check the original oss-sec posting and the VVdeC project release notes.