CVE-2026-45383

Received Received - Intake

Heap Buffer Overflow in libde265 Video Codec

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-45383

Affected Vendors & Products

Vendor	Product	Version / Range
libde265	libde265	to 1.0.19 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap buffer overflow in libde265, an open source H.265 video codec implementation. It occurs when decoding a WPP HEVC slice with crafted PPS/SPS headers. The issue allows reading past the end of an allocated vector in the decoder, potentially leading to memory corruption or crashes.

Detection Guidance

This vulnerability can be detected by checking the version of libde265 installed on your system. If the version is prior to 1.0.19, the system is vulnerable. Use the command 'libde265 --version' to check the installed version.

Impact Analysis

An attacker could exploit this to cause denial of service, execute arbitrary code, or leak sensitive memory. It may also allow bypassing security mechanisms in applications using vulnerable libde265 versions.

Mitigation Strategies

Immediately update libde265 to version 1.0.19 or later to patch the heap buffer overflow vulnerability. If updating is not immediately possible, consider disabling HEVC/WPP decoding features or restricting access to media processing functions until the update is applied.

Hi! I’m here to help you understand CVE-2026-45383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70