Fraunhofer HHI VVdeC before version 3.2.1 contains a heap use‑after‑free flaw. The flaw arises when an ALF adaptation parameter set id is redefined while still referenced by slices. When a crafted VVC bitstream is processed in a multithreaded decoding environment, worker threads dereference freed APS objects within CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(). This can result in application crashes, denial of service, or arbitrary heap corruption if the attacker can influence memory allocation patterns.

The vulnerable product is Fraunhofer HHI VVdeC, with affected releases prior to 3.2.1. No specific sub‑versions are listed, but any build before the 3.2.1 release uses the legacy ParameterSetManager and CABACReader code that is susceptible.

The CVSS score of 5.8 indicates a moderate severity. EPSS is not available, and the vulnerability is not catalogued in CISA KEV, suggesting no currently known widespread exploitation. The attack requires delivery of a malicious VVC bitstream and concurrent multithreaded decoding, which are common in media processing pipelines but may be mitigated by restricting input sources. Based on the provided description, the likely attack vector is through user‑supplied content processed by the decoder.