Threats affecting pkg:github/vvdec

Fraunhofer HHI VVdeC versions up to 3.2.1 have a heap out-of-bounds read vulnerability. This flaw occurs when a crafted VVC bitstream with a collocated picture of a different resolution is processed, causing the decoder to read beyond allocated memory during error concealment. The vulnerability can lead to a crash of the decoder.

Fraunhofer HHI VVdeC versions up to 3.2.1 have a NULL pointer dereference vulnerability in the InterPrediction::xPredInterBlk function. This flaw can be triggered by a crafted VVC bitstream that switches the SPS to enable reference wrap-around, causing the decoder to read from missing buffers and crash. The vulnerability leads to denial of service by crashing the decoder.

Fraunhofer HHI VVdeC versions before 3.2.1 contain an out-of-bounds read vulnerability. This flaw allows attackers to crash the decoder by crafting bitstreams with overlapping slice CTU coverage, causing a negative reference index access during decoding. The issue is fixed in version 3.2.1.

Fraunhofer HHI VVdeC versions before 3.2.1 have a heap out-of-bounds read vulnerability in the SEIReader::xParseSEIScalableNesting function. This flaw allows attackers to read memory beyond allocated heap buffers by miscasting SEI wrapper objects. A crafted VVC bitstream with specific nested SEI messages can trigger this issue, potentially causing a crash or unauthorized memory disclosure.

Fraunhofer HHI VVdeC versions before 3.2.1 have a heap use-after-free vulnerability in the DecLibRecon::createSubPicRefBufs function. This occurs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks, which can lead to heap memory corruption or a decoder crash when processing crafted multi-subpicture VVC bitstreams with two or more threads.

Fraunhofer HHI VVdeC versions before 3.2.1 contain a heap use-after-free vulnerability. This flaw arises when an ALF adaptation parameter set ID is redefined while still referenced by slices, leading to memory corruption. The vulnerability can be triggered by a crafted VVC bitstream during multithreaded decoding, causing worker threads to dereference freed APS objects. This results in crashes or heap corruption.