{"id":"CVE-2026-33165","aliases":["ALPINE-CVE-2026-33165","DEBIAN-CVE-2026-33165","EUVD-2026-13812","GHSA-653q-9f73-8hvg","JLSEC-2026-159","MGASA-2026-0420","ROOT-OS-DEBIAN-12-CVE-2026-33165","ROOT-OS-DEBIAN-13-CVE-2026-33165","UBUNTU-CVE-2026-33165","USN-8573-1"],"status":"published","title":"heap out-of-bounds write in libde265 1.0.16","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00246,"percentile":0.15993,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-03-20T20:32:36Z","modified":"2026-10-28T10:49:26Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"libde265","fixed_in":["1.0.18-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libde265","fixed_in":["1.0.11-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libde265","fixed_in":["1.0.15-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libde265","fixed_in":["1.0.18-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"libde265_jll","fixed_in":["1.0.18000+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","fixed_in":["1.0.2-2ubuntu0.16.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","fixed_in":["1.0.2-2ubuntu0.18.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","fixed_in":["1.0.4-1ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","fixed_in":["1.0.8-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libde265","fixed_in":["1.0.15-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","fixed_in":["1.0.16-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-1+deb12u3"}]}],"versions":["1.0.11-1","1.0.11-1+deb12u1","1.0.11-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1+deb13u2"}]}],"versions":["1.0.15-1","1.0.15-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1"}]}],"versions":["1.0.15-1","1.0.16-1"]},{"source":"osv","ecosystem":"Julia","package":"libde265_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.18000+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-4.1.mga10"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-4.1.mga10.tainted"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.16.04.1~esm6"}]}],"versions":["1.0.2-1build1","1.0.2-2","1.0.2-2ubuntu0.16.04.1~esm1","1.0.2-2ubuntu0.16.04.1~esm2","1.0.2-2ubuntu0.16.04.1~esm3","1.0.2-2ubuntu0.16.04.1~esm4","1.0.2-2ubuntu0.16.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.18.04.1~esm6"}]}],"versions":["1.0.2-2build1","1.0.2-2ubuntu0.18.04.1~esm1","1.0.2-2ubuntu0.18.04.1~esm2","1.0.2-2ubuntu0.18.04.1~esm3","1.0.2-2ubuntu0.18.04.1~esm4","1.0.2-2ubuntu0.18.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1ubuntu0.4+esm2"}]}],"versions":["1.0.3-1build1","1.0.4-1","1.0.4-1build1","1.0.4-1ubuntu0.1","1.0.4-1ubuntu0.2","1.0.4-1ubuntu0.3","1.0.4-1ubuntu0.4","1.0.4-1ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1ubuntu0.3+esm2"}]}],"versions":["1.0.8-1","1.0.8-1ubuntu0.1","1.0.8-1ubuntu0.2","1.0.8-1ubuntu0.3","1.0.8-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1ubuntu0.1"}]}],"versions":["1.0.12-2","1.0.13-1","1.0.15-1","1.0.15-1build1","1.0.15-1build2","1.0.15-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.15-1build5","1.0.16-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1ubuntu0.1~esm1"}]}],"versions":["1.0.16-1","1.0.16-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.16.04.1~esm6"}]}],"versions":["1.0.2-1build1","1.0.2-2","1.0.2-2ubuntu0.16.04.1~esm1","1.0.2-2ubuntu0.16.04.1~esm2","1.0.2-2ubuntu0.16.04.1~esm3","1.0.2-2ubuntu0.16.04.1~esm4","1.0.2-2ubuntu0.16.04.1~esm5"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu0.18.04.1~esm6"}]}],"versions":["1.0.2-2build1","1.0.2-2ubuntu0.18.04.1~esm1","1.0.2-2ubuntu0.18.04.1~esm2","1.0.2-2ubuntu0.18.04.1~esm3","1.0.2-2ubuntu0.18.04.1~esm4","1.0.2-2ubuntu0.18.04.1~esm5"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1ubuntu0.4+esm2"}]}],"versions":["1.0.3-1build1","1.0.4-1","1.0.4-1build1","1.0.4-1ubuntu0.1","1.0.4-1ubuntu0.2","1.0.4-1ubuntu0.3","1.0.4-1ubuntu0.4","1.0.4-1ubuntu0.4+esm1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1ubuntu0.3+esm2"}]}],"versions":["1.0.8-1","1.0.8-1ubuntu0.1","1.0.8-1ubuntu0.2","1.0.8-1ubuntu0.3","1.0.8-1ubuntu0.3+esm1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-1ubuntu0.1"}]}],"versions":["1.0.12-2","1.0.13-1","1.0.15-1","1.0.15-1build1","1.0.15-1build2","1.0.15-1build3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libde265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1ubuntu0.1~esm1"}]}],"versions":["1.0.16-1","1.0.16-1build1"],"bundled":12}],"products":[{"vendor":"struktur","product":"libde265"},{"vendor":"strukturag","product":"libde265"}],"references":[{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg","tags":["x_refsource_CONFIRM","Exploit","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/strukturag/libde265/releases/tag/v1.0.17","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-33165","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33165.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33165","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33165","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0420.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35987","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8573-1","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/issues/460","tags":["report"]},{"url":"https://github.com/strukturag/libde265/issues/484","tags":["report"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3","tags":["advisory"]},{"url":"https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00324.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00397.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-33165","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-61147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54241","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33165","title":"heap out-of-bounds write in libde265 1.0.16","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T20:32:36.603Z","modified":"2026-03-24T18:48:34.866Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13812","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T20:32:36Z","modified":"2026-03-24T18:48:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:25:29.547775Z"}],"nvd":[{"id":"CVE-2026-33165","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T21:17:16.453Z","modified":"2026-06-17T10:37:03.743Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"ALPINE-CVE-2026-33165","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T21:17:16.453Z","modified":"2026-10-01T02:17:49.245700253Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2026-33165","title":"heap out-of-bounds write in libde265 1.0.16","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T20:32:36.603Z","modified":"2026-10-28T10:49:26.917672552Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-33165","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T21:17:16.453Z","modified":"2026-10-01T03:03:04.096347992Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"JLSEC-2026-159","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale `ctb_info.log2unitSize` after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing `set_SliceHeaderIndex` to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","status":"published","published":"2026-04-20T19:31:50.289Z","modified":"2026-07-25T18:23:56.886057756Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-33165","title":"CVE-2026-33165 in libde265 - Patched by Root","description":"Root has patched CVE-2026-33165 in the libde265 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-25T11:02:16Z","modified":"2026-10-01T08:00:06.043862848Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-33165","title":"CVE-2026-33165 in libde265 - Patched by Root","description":"Root has patched CVE-2026-33165 in the libde265 package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T16:09:31Z","modified":"2026-10-01T08:00:06.8889659Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-33165","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.","status":"published","published":"2026-03-20T21:17:00Z","modified":"2026-07-21T13:08:41.512223256Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"MGASA-2026-0420","title":"Updated libde265 package fixes security vulnerabilities","description":"Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers\nto crash the application via crafted payload to display444as420 function\nat sdl.cc. (CVE-2024-38949)\nHeap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers\nto crash the application via crafted payload to __interceptor_memcpy\nfunction. (CVE-2024-38950)\nstrukturag libde265 commit d9fea9d wa discovered to contain a\nsegmentation fault via the component\ndecoder_context::compute_framedrop_table(). (CVE-2025-61147)\nNULL Pointer Dereference in libde265. (CVE-2026-33164)\nHeap out-of-bounds write in libde265 1.0.16. (CVE-2026-33165)\nlibde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via\nunvalidated PPS tile geometry. (CVE-2026-45382)\nlibde265 has a heap buffer overflow (OOB read) in\ndecode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access —\nlibde265 \u003c= v1.0.18. (CVE-2026-45383)\nlibde265 has an out-of-bounds write in process_reference_picture_set via\npredicted short-term RPS. (CVE-2026-49295)\nlibde265 has an unbounded memory leak via orphaned slice headers in\n`read_slice_NAL`. (CVE-2026-49337)\nlibde265 has a heap buffer overflow in de265_image_get_buffer via SPS\ndimension integer overflow. (CVE-2026-49346)\nPixel accessor signed integer overflow causes heap OOB read/write.\n(CVE-2026-54240)\nSAO sequential filter heap buffer overflow via signed integer overflow.\n(CVE-2026-54241)\n","status":"published","published":"2026-09-20T04:25:32Z","modified":"2026-09-20T04:30:03.388103105Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8573-1","title":"libde265 vulnerabilities","description":"It was discovered that libde265 did not properly manage memory under\ncertain circumstances. An attacker could possibly use this issue to\ncause libde265 to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-51792)\n\nIt was discovered that libde265 did not properly handle certain\nmalformed media files, leading to a heap buffer overflow. An attacker\ncould possibly use this issue to cause libde265 to crash, resulting in\na denial of service. (CVE-2024-38949, CVE-2024-38950)\n\nIt was discovered that libde265 did not properly handle certain\nmalformed input, leading to a segmentation fault. An attacker could\npossibly use this issue to cause libde265 to crash, resulting in a\ndenial of service. (CVE-2025-61147)\n\nIt was discovered that libde265 did not properly handle a malformed\nH.265 PPS NAL unit, leading to a segmentation fault. An attacker could\npossibly use this issue to cause libde265 to crash, resulting in a\ndenial of service. (CVE-2026-33164)\n\nIt was discovered that libde265 did not properly handle certain\ncrafted HEVC bitstreams, leading to an out-of-bounds write. An attacker\ncould possibly use this issue to cause libde265 to crash, resulting in\na denial of service. (CVE-2026-33165)\n\nValentin Mercier discovered that libde265 did not properly validate\ntile geometry when handling crafted media files, leading to an\nout-of-bounds read. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or to obtain\nsensitive information. (CVE-2026-45382)\n\nIt was discovered that libde265 did not properly validate certain\nvalues when decoding crafted media files, leading to an out-of-bounds\nread. An attacker could possibly use this issue to cause libde265 to\ncrash, resulting in a denial of service, or to obtain sensitive\ninformation. (CVE-2026-45383)\n\nYing Dong discovered that libde265 did not properly validate reference\npicture set entries when handling a crafted H.265 bitstream, leading to\nan out-of-bounds write. An attacker could possibly use this issue to\ncause libde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-49295)\n\nYing Dong discovered that libde265 did not properly manage memory when\nhandling a crafted sequence of H.265 NAL units, leading to excessive\nmemory consumption. An attacker could possibly use this issue to cause\nlibde265 to use excessive resources, leading to a denial of service.\n(CVE-2026-49337)\n\nYing Dong discovered that libde265 did not properly handle certain\ncrafted H.265 bitstreams with large dimensions, leading to a heap\nbuffer overflow. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-49346)\n\nIt was discovered that libde265 did not properly handle certain crafted\nHEVC bitstreams with large dimensions, leading to an out-of-bounds\nread and write. An attacker could possibly use this issue to cause\nlibde265 to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-54240)\n\nIt was discovered that libde265 did not properly handle certain crafted\nHEVC bitstreams with large dimensions, leading to a heap buffer\noverflow. An attacker could possibly use this issue to cause libde265\nto crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-54241)","status":"published","published":"2026-07-20T19:21:39Z","modified":"2026-09-14T11:17:38.296060606Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}