A heap out‑of‑bounds read occurs when the decoder processes a VVC bitstream that uses TMVP with a smaller collocated reference picture. The CodingStructure::getColInfo function reads past the allocated colMotion buffer, potentially exposing garbage memory or causing a crash. Under CWE‑125 this results in a denial‑of‑service as the decoder terminates and playback or encoding stops.

Fraunhofer HHI’s VVdeC decoder, in all releases up to and including 3.2.1, is vulnerable when error concealment is enabled. The flaw is present in CodingStructure.cpp (lines 453–458) and related logic in Slice.cpp. The product fraunhoferhhi:vvdec is affected, and any installation containing these code paths is at risk.

The CVSS score of 5.7 indicates medium severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting limited observed exploitation. The likely attack vector requires an adversary to supply a carefully crafted VVC bitstream to the decoder – for example, by embedding it in a video file processed by a vulnerable instance. Because the flaw is triggered during decoding, remote network exposure is not mandatory; local execution or infiltration of media ingestion systems would enable exploitation. No publicly known patch is available, so mitigation relies on updating to a non‑vulnerable release or applying protective controls.