Heap Out-of-Bounds Read in Fraunhofer HHI VVdeC

Executive Summary

This vulnerability is a heap out-of-bounds read flaw in Fraunhofer HHI VVdeC through version 3.2.1. Attackers can exploit it by providing a collocated picture with a different resolution than expected. When error concealment is enabled, the decoder attempts to read past allocated memory in the getColInfo function, potentially crashing the application.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash the VVC decoder application, leading to denial-of-service conditions. If exploited, it may cause unexpected behavior or terminate the program, disrupting media processing tasks that rely on the decoder.

Useful 0 Not Useful 0

Mitigation Strategies

Update Fraunhofer HHI VVdeC to version 3.2.1 or later to address the heap out-of-bounds read vulnerability. Disable error concealment features if not required. Monitor for crashes in the decoder when processing VVC bitstreams with TMVP and collocated pictures.

Useful 0 Not Useful 0