CVE-2026-45382
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In libde265 prior to version 1.0.19, there is a heap-buffer-overflow read vulnerability. The flaw in `decoder_context::decode_slice_unit_tiles` allows reading 4 bytes past the allocated buffer via malformed PPS data.
Risk Assessment
An attacker can exploit this vulnerability to read sensitive memory contents, potentially leading to information disclosure or application instability.
Recommendation
Upgrade libde265 to version 1.0.19 or later immediately.
Other vulnerabilities in libde265
See all- CVE-2025-61147Low
A segmentation fault was discovered in the libde265 library (commit d9fea9d) in the decoder_context::compute_framedrop_table() function. This vulnerability may cause crashes in applications using this library.
- CVE-2026-45383Medium
Vulnerability in the libde265 library (H.265 codec implementation) prior to version 1.0.19. A heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` that can be triggered by crafted HEVC streams with WPP, leading to crashes or potentially code execution.
- CVE-2026-49337Medium
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth.
Original NVD description (English source)
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.