Heap Buffer Overflow in libde265 Video Codec

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-45382

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-buffer-overflow in libde265, an open source H.265 video codec implementation. It occurs in the function `decoder_context::decode_slice_unit_tiles` where a malformed Picture Parameter Set (PPS) can cause an out-of-bounds read. The issue arises when `ctbAddrRS` is calculated from PPS-supplied arrays without proper validation against the Picture Size in Coding Tree Blocks (SPS), leading to a 4-byte read beyond allocated memory.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by exploiting a heap-buffer-overflow. If an application processes a maliciously crafted video file, it may crash or allow unintended code execution, potentially leading to system compromise or data breaches.

Mitigation Strategies

Update libde265 to version 1.0.19 or later to address the heap-buffer-overflow vulnerability in decoder_context::decode_slice_unit_tiles.

Hi! I’m here to help you understand CVE-2026-45382. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70