Is CVE-2026-124307 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124307 being exploited in the wild.

How severe is CVE-2026-124307?

Medium severity, with a CVSS score of 5.8, published 7 November 2026.

Which products and versions are affected?

Fraunhofer HHI VVdeC before 3.2.1.

Is there a fix for CVE-2026-124307?

Yes: fixed in 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124307 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124307?

Check whether you run Fraunhofer HHI VVdeC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124307: Fraunhofer HHI VVdeC heap use-after-free in ALF decoding

CVE-2026-124307 · Severity: medium · CVSS 5.8 · Published 2026-11-07

Fraunhofer HHI VVdeC is a video decoder library used to decompress VVC-format video streams. A flaw in its Adaptive Loop Filter (ALF) implementation allows attackers to craft malicious video files that cause memory corruption and application crashes when decoded, potentially leading to denial of service or code execution on systems processing untrusted video content.

Technologies: Fraunhofer HHI VVdeC. Vendors: Fraunhofer HHI.

Quick answers

Is CVE-2026-124307 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124307 being exploited in the wild.
How severe is CVE-2026-124307?: Medium severity, with a CVSS score of 5.8, published 7 November 2026.
Which products and versions are affected?: Fraunhofer HHI VVdeC before 3.2.1.
Is there a fix for CVE-2026-124307?: Yes: fixed in 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124307 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124307?: Check whether you run Fraunhofer HHI VVdeC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.2.1

Technical details

The vulnerability is a heap use-after-free in ALF parameter set handling where attackers can redefine an ALF adaptation parameter set (APS) ID that is still referenced by active video slices. During multithreaded decoding, worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption. Exploitation requires supplying a crafted VVC bitstream and is viable only with multithreaded decoding enabled.

Affected products

Fraunhofer HHI VVdeC before 3.2.1

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.