Is CVE-2026-124308 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124308 being exploited in the wild.

How severe is CVE-2026-124308?

Medium severity, with a CVSS score of 5.8, published 7 November 2026.

Which products and versions are affected?

Fraunhofer HHI VVdeC before 3.2.1.

Is there a fix for CVE-2026-124308?

Yes: fixed in 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124308 attacked?

It is attacked over the network.

Am I affected by CVE-2026-124308?

Check whether you run Fraunhofer HHI VVdeC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124308: Fraunhofer HHI VVdeC heap use-after-free in createSubPicRefBufs

CVE-2026-124308 · Severity: medium · CVSS 5.8 · Published 2026-11-07

Fraunhofer HHI VVdeC is a video decoder library used to process VVC (Versatile Video Codec) streams. A heap use-after-free vulnerability in the multi-threaded decoder can be triggered by a crafted video file, leading to memory corruption or decoder crashes when processing videos with multiple subpictures.

Technologies: Fraunhofer HHI VVdeC. Vendors: Fraunhofer HHI.

Quick answers

Is CVE-2026-124308 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124308 being exploited in the wild.
How severe is CVE-2026-124308?: Medium severity, with a CVSS score of 5.8, published 7 November 2026.
Which products and versions are affected?: Fraunhofer HHI VVdeC before 3.2.1.
Is there a fix for CVE-2026-124308?: Yes: fixed in 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124308 attacked?: It is attacked over the network.
Am I affected by CVE-2026-124308?: Check whether you run Fraunhofer HHI VVdeC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.2.1

Technical details

The vulnerability is a heap use-after-free in DecLibRecon::createSubPicRefBufs where the decompressPicture function clears m_subPicExtTasks without waiting for pending asynchronous tasks to complete. An attacker supplying a crafted multi-subpicture VVC bitstream to a decoder using two or more threads can trigger heap memory corruption or denial of service. The fix is available in version 3.2.1.

Affected products

Fraunhofer HHI VVdeC before 3.2.1

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.