Is CVE-2026-124310 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124310 being exploited in the wild.

How severe is CVE-2026-124310?

Medium severity, with a CVSS score of 6.1, published 7 November 2026.

Which products and versions are affected?

Fraunhofer HHI VVdeC before 3.2.1.

Is there a fix for CVE-2026-124310?

Yes: fixed in 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124310 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124310?

Check whether you run Fraunhofer HHI VVdeC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124310: Fraunhofer HHI VVdeC out-of-bounds read in inter prediction

CVE-2026-124310 · Severity: medium · CVSS 6.1 · Published 2026-11-07

VVdeC is a video decoder library used to decompress video streams. An attacker can craft a malicious video file with specially overlapping slice segments that causes the decoder to read from invalid memory locations and crash, resulting in a denial of service.

Technologies: Fraunhofer HHI VVdeC. Vendors: Fraunhofer HHI.

Quick answers

Is CVE-2026-124310 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124310 being exploited in the wild.
How severe is CVE-2026-124310?: Medium severity, with a CVSS score of 6.1, published 7 November 2026.
Which products and versions are affected?: Fraunhofer HHI VVdeC before 3.2.1.
Is there a fix for CVE-2026-124310?: Yes: fixed in 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124310 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124310?: Check whether you run Fraunhofer HHI VVdeC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.2.1

Technical details

An out-of-bounds read vulnerability exists in the inter prediction module when processing bi-predicted BDOF coding units with negative reference indices. Attackers can construct bitstreams with overlapping slice CTU coverage across multiple slices that trigger Slice::getRefPic to access m_apcRefPicList outside bounds. The vulnerability requires no authentication or user interaction beyond supplying a crafted video bitstream.

Affected products

Fraunhofer HHI VVdeC before 3.2.1

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.