Fraunhofer HHI VVdeC through version 3.2.1 contains a null pointer dereference in the function InterPrediction::xPredInterBlk. When a Sequence Parameter Set (SPS) is switched to enable reference wrap‑around, the decoder attempts to read from a missing PIC_RECON_WRAP buffer. The resulting read causes the application to crash, providing a denial‑of‑service capability to an attacker who can craft a malicious VVC bitstream that activates this path. The weakness is a CWE‑476 type null pointer dereference and is specific to the VVC decoding component.

The vulnerability affects installations of Fraunhofer HHI VVdeC up to and including version 3.2.1. Systems that deploy this library for video decoding—such as media players, streaming servers, or embedded devices that host a VVC decoder—are potentially impacted. No other products were listed as affected, and no additional versions are disclosed in the data.

The CVSS base score of 6.8 indicates a moderate severity for a denial of service vulnerability. EPSS data is not available, so the probability of exploitation cannot be quantified in that metric. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no known large‑scale exploits have been observed yet. Attackers would need to supply a crafted VVC stream containing an SPS with sps_ref_wraparound_enabled_flag set; the inference here is that the attack vector is typically local or remote via any channel that allows injection of such a stream into the decoder. The impact is a crash of the decoding application, which if in a critical service could lead to a denial of service for end users.