CVE-2024-38950

In libde265 before version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation.

In libde265 (an open source H.265 codec implementation), a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). The issue is patched in version 1.0.17.

A heap buffer overflow exists in Libde265 v1.0.15 in the display444as420 function in sdl.cc. An attacker can crash the application via a crafted payload.

A segmentation fault was discovered in the libde265 library (commit d9fea9d) in the decoder_context::compute_framedrop_table() function. This vulnerability may cause crashes in applications using this library.

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes.

Vulnerability in the libde265 library (H.265 codec implementation) prior to version 1.0.19. A heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` that can be triggered by crafted HEVC streams with WPP, leading to crashes or potentially code execution.

In libde265 prior to version 1.0.19, there is a heap-buffer-overflow read vulnerability. The flaw in `decoder_context::decode_slice_unit_tiles` allows reading 4 bytes past the allocated buffer via malformed PPS data.

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth.