NULL Pointer Dereference Vulnerability in libde265 Library by strukturag

CVE-2026-88373

What is CVE-2026-88373?

The vulnerability in the libde265 library arises due to improper handling of zero-length NAL units during parsing. Specifically, when a function processes a zero-length NAL unit, it may lead to a NULL backing buffer being passed to memcpy(). This results in undefined behavior, which can ultimately cause the application to terminate unexpectedly or experience denial of service in builds that utilize Undefined Behavior Sanitizer (UBSan). Ensuring that NAL units are correctly validated before processing is crucial to prevent this issue.

References