Executive brief
libde265 is an open-source library used to decode H.265 (HEVC) video files, often found in image viewers and media players. A vulnerability in how the library handles malformed video data could allow an attacker to cause a program crash by providing a specially crafted video or image file. This could lead to a denial-of-service, interrupting operations or causing applications using the library to fail.
Technical details
An out-of-bounds (OOB) read vulnerability exists in libde265 prior to version 1.0.19 within the `decoder_context::decode_slice_unit_tiles` function in `decctx.cc`. The root cause is a failure to validate the `ctbAddrRS` index, calculated from Picture Parameter Set (PPS) supplied `colBd[]` and `rowBd[]` arrays, against the size of the `CtbAddrRStoTS` vector. An attacker can provide a malformed PPS with geometry inconsistent with the Sequence Parameter Set (SPS) to trigger a 4-byte heap-buffer-overflow read. This vulnerability specifically affects the parallel-tile decoding path when worker threads are enabled. The issue is fixed in version 1.0.19.
Affected products
- strukturag libde265 < 1.0.19
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: NVD publication date