CVE-2026-88373
Low risk· EPSS 4%Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.
Risk Assessment
This can lead to denial of service when processing specially crafted video streams.
Recommendation
Update libde265 to a patched version or restrict processing of untrusted video data.
Other vulnerabilities in libde265
See all- CVE-2025-61147Low
A segmentation fault was discovered in the libde265 library (commit d9fea9d) in the decoder_context::compute_framedrop_table() function. This vulnerability may cause crashes in applications using this library.
- CVE-2026-54241High
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read.
- CVE-2026-54240High
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes.
- CVE-2026-45383Medium
Vulnerability in the libde265 library (H.265 codec implementation) prior to version 1.0.19. A heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` that can be triggered by crafted HEVC streams with WPP, leading to crashes or potentially code execution.
- CVE-2026-45382Medium
In libde265 prior to version 1.0.19, there is a heap-buffer-overflow read vulnerability. The flaw in `decoder_context::decode_slice_unit_tiles` allows reading 4 bytes past the allocated buffer via malformed PPS data.
- CVE-2026-49337Medium
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth.
Original NVD description (English source)
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS