Fraunhofer HHI VVdeC before 3.2.1 contains a heap use‑after‑free vulnerability in the DecLibRecon::createSubPicRefBufs function. The vulnerability arises when decodePicture clears the m_subPicExtTasks list while background tasks may still be running, causing freed memory to be accessed again. An attacker could supply a crafted multi‑subpicture VVC bitstream to a decoder that performs decoding on multiple threads, which may result in heap memory corruption or a crash of the decoding process.

The affected product is Fraunhofer HHI VVdeC. All releases older than version 3.2.1 are susceptible because they contain the vulnerable implementation. Specific version details are not listed beyond the 3.2.1 cutoff.

The CVSS base score of 5.8 indicates moderate severity, while the EPSS score is not available, making it difficult to gauge exploit probability. The vulnerability is not yet listed in the CISA KEV catalog, and no public exploits have been reported. The likely attack vector is an attacker feeding a maliciously crafted VVC bitstream that contains multiple sub‑pictures to a decoder that is executing in a multi‑threaded environment, which could lead to buffer corruption or a crash. Depending on the deployment model, this could affect local users running the decoder application or remote services that accept untrusted media.