Is CVE-2026-45383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45383 being exploited in the wild.

How severe is CVE-2026-45383?

Informational severity, with a CVSS score of 6.9, published 21 July 2026.

Is there a fix for CVE-2026-45383?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45383 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45383?

Check whether you run struktur AG Libde265 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45383: Strukturag libde265 heap buffer overflow in decode_slice_unit_WPP

CVE-2026-45383 · Severity: info · CVSS 6.9 · Published 2026-07-21

libde265 is an open-source library used to decode H.265 (HEVC) video files, commonly found in image viewers and media players. A flaw in how the library handles specific video headers allows a specially crafted video or image file to cause the application to read memory outside of its intended boundaries. This can lead to application crashes or the potential exposure of sensitive information from the computer's memory.

Technologies: struktur AG Libde265. Vendors: struktur AG.

Quick answers

Is CVE-2026-45383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45383 being exploited in the wild.
How severe is CVE-2026-45383?: Informational severity, with a CVSS score of 6.9, published 21 July 2026.
Which products and versions are affected?: struktur AG Libde265 < 1.0.19.
Is there a fix for CVE-2026-45383?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45383 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45383?: Check whether you run struktur AG Libde265 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based out-of-bounds read exists in the `decoder_context::decode_slice_unit_WPP()` function within `libde265/decctx.cc`. The vulnerability is triggered when decoding a Wavefront Parallel Processing (WPP) HEVC slice where crafted PPS/SPS headers cause the calculated `ctbAddrRS` index to exceed the bounds of the `pps.CtbAddrRStoTS` vector. An attacker can exploit this by providing a malicious HEVC/HEIF file, leading to an out-of-bounds read of adjacent heap memory. This can result in information disclosure or application instability. The issue is fixed in version 1.0.19.

Affected products

strukturag libde265 < 1.0.19

Timeline

2026-03-27: other: Vulnerability confirmed present in master branch
2026-05-19: advisory: GitHub Security Advisory published
2026-07-21: disclosed: CVE published to NVD

References

https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.