Threats tagged 'ghsa-g75c-jvvc-4qf4'

Fraunhofer HHI VVdeC versions before 3.2.1 have a heap use-after-free vulnerability in the DecLibRecon::createSubPicRefBufs function. This occurs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks to complete. An attacker can exploit this by supplying a crafted multi-subpicture VVC bitstream to decoders running with two or more threads, potentially causing heap memory corruption or a decoder crash.