Heap Out-of-Bounds Read in Fraunhofer HHI VVdeC

Executive Summary

This vulnerability is a heap out-of-bounds read issue in Fraunhofer HHI VVdeC before version 3.2.1. It occurs in the SEIReader::xParseSEIScalableNesting function where attackers can exploit a crafted VVC bitstream containing a scalable nesting SEI with a nested buffering period SEI. The flaw allows reading past allocated heap memory by incorrectly casting the SEI wrapper object instead of its payload, potentially crashing the decoder or copying adjacent heap memory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash the decoder application or leak sensitive data from adjacent memory. If exploited, it may lead to denial-of-service conditions or unauthorized information disclosure. The impact depends on the context in which VVdeC is used, such as media processing or streaming applications.

Useful 0 Not Useful 0

Mitigation Strategies

Update Fraunhofer HHI VVdeC to version 3.2.1 or later to address the heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting.

Useful 0 Not Useful 0