Heap Buffer Overflow in libde265 H.265 Video Codec Implementation by strukturag
CVE-2026-45383

6.9MEDIUM

Key Information:

Vendor

Strukturag

Status
Libde265
Vendor
CVE Published:
21 July 2026

What is CVE-2026-45383?

The libde265 library, which implements the H.265 video codec, is susceptible to a heap buffer overflow due to improper handling of slice decoding. Specifically, in the function decoder_context::decode_slice_unit_WPP(), if the crafted PPS/SPS headers result in ctbAddrRS exceeding pps.CtbAddrRStoTS.size(), it triggers an out-of-bounds read when accessing pps.CtbAddrRStoTS[ctbAddrRS]. This vulnerability can be exploited during the decoding of a WPP (Wavefront Parallel Processing) HEVC slice, leading to potential security risks. The issue has been addressed in version 1.0.19, underscoring the importance of updating to mitigate such vulnerabilities.

Affected Version(s)

libde265 < 1.0.19

References

https://github.com/strukturag/libde265/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.