CVE-2026-54240

Received Received - Intake

Integer Overflow in libde265 HEVC Decoder

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-54240

Affected Vendors & Products

Vendor	Product	Version / Range
libde265	libde265	to 1.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in libde265, an open source H.265 video codec implementation. Versions before 1.1.1 use 32-bit arithmetic to calculate pixel offsets in HEVC video streams. A specially crafted stream with large image dimensions can trigger an integer overflow, leading to out-of-bounds heap memory reads or writes. This may result in data disclosure, memory corruption, or application crashes.

Detection Guidance

Detecting this vulnerability requires analyzing libde265 versions and inspecting HEVC streams for large image dimensions. Check installed versions with 'dpkg -l libde265' or 'rpm -qa | grep libde265'. Monitor for crashes or memory corruption when processing HEVC files. No direct commands detect the flaw without prior knowledge of affected versions or streams.

Impact Analysis

If exploited, this flaw could allow attackers to read sensitive data from memory, corrupt program memory leading to crashes or unexpected behavior, or potentially execute arbitrary code. Users processing untrusted video files may experience application instability or information leaks.

Compliance Impact

This vulnerability could lead to out-of-bounds heap reads or writes, potentially disclosing sensitive data or corrupting memory. For GDPR, this may result in unauthorized data exposure, violating confidentiality principles. For HIPAA, it could compromise protected health information integrity or availability.

Mitigation Strategies

Upgrade libde265 to version 1.1.1 or later immediately. Disable or restrict processing of HEVC files from untrusted sources. Apply patches if available through your package manager. Monitor for unusual memory usage or crashes in media applications.

Hi! I’m here to help you understand CVE-2026-54240. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70