# CVE-2026-45382: strukturag libde265 out-of-bounds read in decode_slice_unit_tiles

Source: https://junglewise.ai/threats/cve-2026-45382-strukturag-libde265-out-of-bounds-read-in-decode-slice-unit-tiles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-45382 · Severity: info · CVSS 6.9 · Published 2026-07-21

libde265 is an open-source library used to decode H.265 (HEVC) video files, often found in image viewers and media players. A vulnerability in how the library handles malformed video data could allow an attacker to cause a program crash by providing a specially crafted video or image file. This could lead to a denial-of-service, interrupting operations or causing applications using the library to fail.

Technologies: [struktur AG Libde265](https://junglewise.ai/threats/technologies/libde265). Vendors: [struktur AG](https://junglewise.ai/threats/vendors/struktur-ag).

## Quick answers

**Is CVE-2026-45382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45382 being exploited in the wild.

**How severe is CVE-2026-45382?** Informational severity, with a CVSS score of 6.9, published 21 July 2026.

**Which products and versions are affected?** struktur AG Libde265 < 1.0.19.

**Is there a fix for CVE-2026-45382?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45382 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45382?** Check whether you run struktur AG Libde265 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds (OOB) read vulnerability exists in libde265 prior to version 1.0.19 within the `decoder_context::decode_slice_unit_tiles` function in `decctx.cc`. The root cause is a failure to validate the `ctbAddrRS` index, calculated from Picture Parameter Set (PPS) supplied `colBd[]` and `rowBd[]` arrays, against the size of the `CtbAddrRStoTS` vector. An attacker can provide a malformed PPS with geometry inconsistent with the Sequence Parameter Set (SPS) to trigger a 4-byte heap-buffer-overflow read. This vulnerability specifically affects the parallel-tile decoding path when worker threads are enabled. The issue is fixed in version 1.0.19.

## Affected products

- strukturag libde265 < 1.0.19

## Timeline

- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: NVD publication date

## References

- [https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9](https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9)

## Related threats

- [Strukturag libde265 heap buffer overflow in decode_slice_unit_WPP](https://junglewise.ai/threats/cve-2026-45383-strukturag-libde265-heap-buffer-overflow-in-decode-slice-unit-wpp)
- [Strukturag libde265 heap buffer overflow in de265_image_get_buffer](https://junglewise.ai/threats/cve-2026-49346-strukturag-libde265-heap-buffer-overflow-in-de265-image-get)
- [Strukturag libde265 unbounded heap growth in read_slice_NAL](https://junglewise.ai/threats/cve-2026-49337-strukturag-libde265-unbounded-heap-growth-in-read-slice-nal)
- [Strukturag libde265 out-of-bounds write in process_reference_picture_set](https://junglewise.ai/threats/cve-2026-49295-strukturag-libde265-out-of-bounds-write-in-process-reference)