Threats tagged 'ghsa-w892-xhp2-gg6x'

Fraunhofer HHI VVdeC versions before 3.2.1 have a heap out-of-bounds read vulnerability in the SEIReader::xParseSEIScalableNesting function. This flaw allows attackers to read memory beyond allocated heap buffers by miscasting the SEI wrapper object instead of its payload. Exploitation requires supplying a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI, which can cause the decoder to crash or leak adjacent heap memory.