# CVE-2026-124307: Fraunhofer HHI VVdeC heap use-after-free in ALF decoding

Source: https://junglewise.ai/threats/cve-2026-124307-fraunhofer-hhi-vvdec-before-3-2-1-contains-a-heap-use-after-free  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-124307 · Severity: medium · CVSS 5.8 · Published 2026-11-07

Fraunhofer HHI VVdeC is a video decoder library used to decompress VVC-format video streams. A flaw in its Adaptive Loop Filter (ALF) implementation allows attackers to craft malicious video files that cause memory corruption and application crashes when decoded, potentially leading to denial of service or code execution on systems processing untrusted video content.

Technologies: [Fraunhofer HHI VVdeC](https://junglewise.ai/threats/technologies/vvdec). Vendors: [Fraunhofer HHI](https://junglewise.ai/threats/vendors/fraunhofer-hhi).

## Quick answers

**Is CVE-2026-124307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124307 being exploited in the wild.

**How severe is CVE-2026-124307?** Medium severity, with a CVSS score of 5.8, published 7 November 2026.

**Which products and versions are affected?** Fraunhofer HHI VVdeC before 3.2.1.

**Is there a fix for CVE-2026-124307?** Yes: fixed in 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124307 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124307?** Check whether you run Fraunhofer HHI VVdeC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.2.1

## Technical details

The vulnerability is a heap use-after-free in ALF parameter set handling where attackers can redefine an ALF adaptation parameter set (APS) ID that is still referenced by active video slices. During multithreaded decoding, worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption. Exploitation requires supplying a crafted VVC bitstream and is viable only with multithreaded decoding enabled.

## Affected products

- Fraunhofer HHI VVdeC before 3.2.1

## Timeline

- 2026-11-07: disclosed

## References

- [https://github.com/fraunhoferhhi/vvdec](https://github.com/fraunhoferhhi/vvdec)
- [https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/ParameterSetManager.h](https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/ParameterSetManager.h)

## Related threats

- [Fraunhofer HHI VVdeC heap out-of-bounds read](https://junglewise.ai/threats/cve-2026-124312-fraunhofer-hhi-vvdec-through-3-2-1-contains-a-heap-out-of-bounds)
- [Fraunhofer HHI VVdeC NULL pointer dereference in InterPrediction](https://junglewise.ai/threats/cve-2026-124311-fraunhofer-hhi-vvdec-through-3-2-1-contains-a-null-pointer)
- [Fraunhofer HHI VVdeC out-of-bounds read in inter prediction](https://junglewise.ai/threats/cve-2026-124310-fraunhofer-hhi-vvdec-before-3-2-1-contains-an-out-of-bounds-read)
- [Fraunhofer HHI VVdeC heap out-of-bounds read in SEI parsing](https://junglewise.ai/threats/cve-2026-124309-fraunhofer-hhi-vvdec-before-3-2-1-contains-a-heap-out-of-bounds)
- [Fraunhofer HHI VVdeC heap use-after-free in createSubPicRefBufs](https://junglewise.ai/threats/cve-2026-124308-fraunhofer-hhi-vvdec-before-3-2-1-contains-a-heap-use-after-free)