What’s Vulnerable › Vulnerabilities

CVE-2026-45382: libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-10-24
• Weakness: CWE-125

Description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.

Affected products

• strukturag libde265: before 1.0.19

References

• https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9
• https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9

Get alerted when CVE-2026-45382 or the next vulnerability affects your stack