The vulnerability is a heap out‑of‑bounds read in the SEIReader::xParseSEIScalableNesting function. An attacker can supply a crafted VVC bitstream that causes the decoder to read memory beyond the intended buffer by incorrectly treating the SEI wrapper object as a payload. This out‑of‑bounds read can expose adjacent heap data and lead to a crash of the decoder, resulting in a denial‑of‑service condition without executing arbitrary code.

This flaw exists in Fraunhofer HHI's open‑source VVC decoder, vvdec, in all releases prior to version 3.2.1. Users relying on vvdec versions earlier than 3.2.1 are affected.

The vulnerability carries a CVSS score of 6.9, indicating a moderate severity. The EPSS score is not available, so no exploitation probability estimate is provided. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to supply a malicious VVC bitstream to the vulnerable decoder, which can occur in any environment where vvdec processes user‑supplied media, such as multimedia applications, streaming services, or embedded devices that decode VVC content. Because the flaw is a read‑only memory corruption, it does not allow remote code execution but can lead to data leakage or instability, making it a notable risk for trusted media pipelines.