CVE-2026-45382

Deferred Deferred - Pending Action

Heap Buffer Overflow in libde265 Video Codec

Publication date: 2026-07-21

Last updated on: 2026-07-23

Assigner: GitHub, Inc.

Description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-23

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-45382

Affected Vendors & Products

Vendor	Product	Version / Range
libde265	libde265	1.0.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-buffer-overflow in libde265, an open source H.265 video codec implementation. It occurs in the function `decoder_context::decode_slice_unit_tiles` where a malformed Picture Parameter Set (PPS) can cause an out-of-bounds read. The issue arises when `ctbAddrRS` is calculated from PPS-supplied arrays without proper validation against the Picture Size in Coding Tree Blocks (SPS), leading to a 4-byte read beyond allocated memory.

Detection Guidance

This vulnerability involves a heap-buffer-overflow in libde265 due to improper validation of tile geometry in PPS. Detection requires checking for crashes or memory corruption when processing H.265 streams. Monitor for segmentation faults or heap errors during video decoding. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by exploiting a heap-buffer-overflow. If an application processes a maliciously crafted video file, it may crash or allow unintended code execution, potentially leading to system compromise or data breaches.

Compliance Impact

The vulnerability involves a heap-buffer-overflow in libde265's video decoding, which could lead to memory corruption or crashes. While not directly tied to GDPR or HIPAA, such vulnerabilities may impact compliance by exposing systems to unauthorized access or data leaks if exploited. However, the provided CVE details do not specify direct compliance implications.

Mitigation Strategies

Update libde265 to version 1.0.19 or later to address the heap-buffer-overflow vulnerability in decoder_context::decode_slice_unit_tiles.

Hi! I’m here to help you understand CVE-2026-45382. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70