The vulnerability is an out‑of‑bounds read in the Slice::getRefPic method of the Fraunhofer HHI VVdeC decoder. A crafted video stream containing overlapping CTU coverage can cause the decoder to read memory outside the intended reference picture list, leading to a crash of the application that uses the decoder. This results in a denial‑of‑service condition where the media component becomes unresponsive and may require restart for continued operation.

The flaw exists in all releases of the Fraunhofer HHI VVdeC decoder before version 3.2.1. The product is an open‑source video‑processing library employed in embedded and media‑processing systems. Any deployment that integrates vvdec 3.0, 3.1 or earlier is vulnerable.

The CVSS base score of 6.9 indicates moderate severity, and no EPSS data is available; the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation. The attack vector requires an attacker to supply a malicious bitstream to the decoder, which is feasible in networked media services or any software that processes untrusted media. Because the flaw leads only to a crash and does not provide code execution, the impact is restricted to service disruption.