{"id":"CVE-2026-33164","aliases":["ALPINE-CVE-2026-33164","DEBIAN-CVE-2026-33164","EUVD-2026-13810","GHSA-wqrf-6rf5-v78r","JLSEC-2026-158","MGASA-2026-0420","ROOT-OS-DEBIAN-12-CVE-2026-33164","ROOT-OS-DEBIAN-13-CVE-2026-33164","UBUNTU-CVE-2026-33164","USN-8573-1"],"status":"published","title":"NULL Pointer Dereference in libde265","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00363,"percentile":0.30407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-476"],"published":"2026-03-20T20:33:04Z","modified":"2026-10-28T11:11:48Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"libde265","fixed_in":["1.0.18-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libde265","fixed_in":["1.0.11-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libde265","fixed_in":["1.0.15-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libde265","fixed_in":["1.0.18-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"libde265_jll","fixed_in":["1.0.18000+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","fixed_in":["1.0.2-2ubuntu0.16.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","fixed_in":["1.0.2-2ubuntu0.18.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","fixed_in":["1.0.4-1ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","fixed_in":["1.0.8-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libde265","fixed_in":["1.0.15-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","fixed_in":["1.0.16-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-1+deb12u3"}]}],"versions":["1.0.11-1","1.0.11-1+deb12u1","1.0.11-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1+deb13u2"}]}],"versions":["1.0.15-1","1.0.15-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1"}]}],"versions":["1.0.15-1","1.0.16-1"]},{"source":"osv","ecosystem":"Julia","package":"libde265_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.18000+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-4.1.mga10"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-4.1.mga10.tainted"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.16.04.1~esm6"}]}],"versions":["1.0.2-1build1","1.0.2-2","1.0.2-2ubuntu0.16.04.1~esm1","1.0.2-2ubuntu0.16.04.1~esm2","1.0.2-2ubuntu0.16.04.1~esm3","1.0.2-2ubuntu0.16.04.1~esm4","1.0.2-2ubuntu0.16.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.18.04.1~esm6"}]}],"versions":["1.0.2-2build1","1.0.2-2ubuntu0.18.04.1~esm1","1.0.2-2ubuntu0.18.04.1~esm2","1.0.2-2ubuntu0.18.04.1~esm3","1.0.2-2ubuntu0.18.04.1~esm4","1.0.2-2ubuntu0.18.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1ubuntu0.4+esm2"}]}],"versions":["1.0.3-1build1","1.0.4-1","1.0.4-1build1","1.0.4-1ubuntu0.1","1.0.4-1ubuntu0.2","1.0.4-1ubuntu0.3","1.0.4-1ubuntu0.4","1.0.4-1ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1ubuntu0.3+esm2"}]}],"versions":["1.0.8-1","1.0.8-1ubuntu0.1","1.0.8-1ubuntu0.2","1.0.8-1ubuntu0.3","1.0.8-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1ubuntu0.1"}]}],"versions":["1.0.12-2","1.0.13-1","1.0.15-1","1.0.15-1build1","1.0.15-1build2","1.0.15-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.15-1build5","1.0.16-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1ubuntu0.1~esm1"}]}],"versions":["1.0.16-1","1.0.16-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.16.04.1~esm6"}]}],"versions":["1.0.2-1build1","1.0.2-2","1.0.2-2ubuntu0.16.04.1~esm1","1.0.2-2ubuntu0.16.04.1~esm2","1.0.2-2ubuntu0.16.04.1~esm3","1.0.2-2ubuntu0.16.04.1~esm4","1.0.2-2ubuntu0.16.04.1~esm5"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.18.04.1~esm6"}]}],"versions":["1.0.2-2build1","1.0.2-2ubuntu0.18.04.1~esm1","1.0.2-2ubuntu0.18.04.1~esm2","1.0.2-2ubuntu0.18.04.1~esm3","1.0.2-2ubuntu0.18.04.1~esm4","1.0.2-2ubuntu0.18.04.1~esm5"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1ubuntu0.4+esm2"}]}],"versions":["1.0.3-1build1","1.0.4-1","1.0.4-1build1","1.0.4-1ubuntu0.1","1.0.4-1ubuntu0.2","1.0.4-1ubuntu0.3","1.0.4-1ubuntu0.4","1.0.4-1ubuntu0.4+esm1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1ubuntu0.3+esm2"}]}],"versions":["1.0.8-1","1.0.8-1ubuntu0.1","1.0.8-1ubuntu0.2","1.0.8-1ubuntu0.3","1.0.8-1ubuntu0.3+esm1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1ubuntu0.1"}]}],"versions":["1.0.12-2","1.0.13-1","1.0.15-1","1.0.15-1build1","1.0.15-1build2","1.0.15-1build3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1ubuntu0.1~esm1"}]}],"versions":["1.0.16-1","1.0.16-1build1"],"bundled":12}],"products":[{"vendor":"struktur","product":"libde265"},{"vendor":"strukturag","product":"libde265"}],"references":[{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/strukturag/libde265/releases/tag/v1.0.17","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-33164","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33164.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33164","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33164","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0420.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35987","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8573-1","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/issues/460","tags":["report"]},{"url":"https://github.com/strukturag/libde265/issues/484","tags":["report"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00324.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00397.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-33164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-61147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54241","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33164","title":"NULL Pointer Dereference in libde265","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T20:33:04.054Z","modified":"2026-03-23T16:50:53.124Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13810","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T20:33:04Z","modified":"2026-03-23T16:50:53Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:30.696372Z"}],"nvd":[{"id":"CVE-2026-33164","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T21:17:16.233Z","modified":"2026-06-17T10:37:03.61Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-122","CWE-476"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"ALPINE-CVE-2026-33164","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T21:17:16.233Z","modified":"2026-10-01T02:17:49.245111081Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2026-33164","title":"NULL Pointer Dereference in libde265","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T20:33:04.054Z","modified":"2026-10-28T11:11:48.989323789Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-33164","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T21:17:16.233Z","modified":"2026-10-01T03:03:04.089308237Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"JLSEC-2026-158","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in `pic_parameter_set::set_derived_values()`. This issue has been patched in version 1.0.17.","status":"published","published":"2026-04-20T19:31:50.289Z","modified":"2026-07-25T18:23:56.817305952Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-33164","title":"CVE-2026-33164 in libde265 - Patched by Root","description":"Root has patched CVE-2026-33164 in the libde265 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-25T11:02:16Z","modified":"2026-10-01T08:00:06.043402762Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-33164","title":"CVE-2026-33164 in libde265 - Patched by Root","description":"Root has patched CVE-2026-33164 in the libde265 package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T16:09:31Z","modified":"2026-10-01T08:00:06.888223154Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-33164","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T21:17:00Z","modified":"2026-07-21T13:08:41.643265083Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"MGASA-2026-0420","title":"Updated libde265 package fixes security vulnerabilities","description":"Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers\nto crash the application via crafted payload to display444as420 function\nat sdl.cc. (CVE-2024-38949)\nHeap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers\nto crash the application via crafted payload to __interceptor_memcpy\nfunction. (CVE-2024-38950)\nstrukturag libde265 commit d9fea9d wa discovered to contain a\nsegmentation fault via the component\ndecoder_context::compute_framedrop_table(). (CVE-2025-61147)\nNULL Pointer Dereference in libde265. (CVE-2026-33164)\nHeap out-of-bounds write in libde265 1.0.16. (CVE-2026-33165)\nlibde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via\nunvalidated PPS tile geometry. (CVE-2026-45382)\nlibde265 has a heap buffer overflow (OOB read) in\ndecode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access —\nlibde265 \u003c= v1.0.18. (CVE-2026-45383)\nlibde265 has an out-of-bounds write in process_reference_picture_set via\npredicted short-term RPS. (CVE-2026-49295)\nlibde265 has an unbounded memory leak via orphaned slice headers in\n`read_slice_NAL`. (CVE-2026-49337)\nlibde265 has a heap buffer overflow in de265_image_get_buffer via SPS\ndimension integer overflow. (CVE-2026-49346)\nPixel accessor signed integer overflow causes heap OOB read/write.\n(CVE-2026-54240)\nSAO sequential filter heap buffer overflow via signed integer overflow.\n(CVE-2026-54241)\n","status":"published","published":"2026-09-20T04:25:32Z","modified":"2026-09-20T04:30:03.388103105Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8573-1","title":"libde265 vulnerabilities","description":"It was discovered that libde265 did not properly manage memory under\ncertain circumstances. An attacker could possibly use this issue to\ncause libde265 to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-51792)\n\nIt was discovered that libde265 did not properly handle certain\nmalformed media files, leading to a heap buffer overflow. An attacker\ncould possibly use this issue to cause libde265 to crash, resulting in\na denial of service. (CVE-2024-38949, CVE-2024-38950)\n\nIt was discovered that libde265 did not properly handle certain\nmalformed input, leading to a segmentation fault. An attacker could\npossibly use this issue to cause libde265 to crash, resulting in a\ndenial of service. (CVE-2025-61147)\n\nIt was discovered that libde265 did not properly handle a malformed\nH.265 PPS NAL unit, leading to a segmentation fault. An attacker could\npossibly use this issue to cause libde265 to crash, resulting in a\ndenial of service. (CVE-2026-33164)\n\nIt was discovered that libde265 did not properly handle certain\ncrafted HEVC bitstreams, leading to an out-of-bounds write. An attacker\ncould possibly use this issue to cause libde265 to crash, resulting in\na denial of service. (CVE-2026-33165)\n\nValentin Mercier discovered that libde265 did not properly validate\ntile geometry when handling crafted media files, leading to an\nout-of-bounds read. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or to obtain\nsensitive information. (CVE-2026-45382)\n\nIt was discovered that libde265 did not properly validate certain\nvalues when decoding crafted media files, leading to an out-of-bounds\nread. An attacker could possibly use this issue to cause libde265 to\ncrash, resulting in a denial of service, or to obtain sensitive\ninformation. (CVE-2026-45383)\n\nYing Dong discovered that libde265 did not properly validate reference\npicture set entries when handling a crafted H.265 bitstream, leading to\nan out-of-bounds write. An attacker could possibly use this issue to\ncause libde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-49295)\n\nYing Dong discovered that libde265 did not properly manage memory when\nhandling a crafted sequence of H.265 NAL units, leading to excessive\nmemory consumption. An attacker could possibly use this issue to cause\nlibde265 to use excessive resources, leading to a denial of service.\n(CVE-2026-49337)\n\nYing Dong discovered that libde265 did not properly handle certain\ncrafted H.265 bitstreams with large dimensions, leading to a heap\nbuffer overflow. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-49346)\n\nIt was discovered that libde265 did not properly handle certain crafted\nHEVC bitstreams with large dimensions, leading to an out-of-bounds\nread and write. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-54240)\n\nIt was discovered that libde265 did not properly handle certain crafted\nHEVC bitstreams with large dimensions, leading to a heap buffer\noverflow. An attacker could possibly use this issue to cause libde265\nto crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-54241)","status":"published","published":"2026-07-20T19:21:39Z","modified":"2026-09-14T11:17:38.296060606Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}