Executive brief
libde265 is an open-source library used by various applications to decode H.265 (HEVC) video files. A vulnerability in how the library handles specially crafted video files could allow an attacker to crash an application or potentially gain unauthorized control of a system when a user opens a malicious video. This issue stems from a memory management error that occurs when processing videos with extremely large dimensions.
Technical details
A heap buffer overflow exists in libde265 prior to version 1.1.0 due to a signed integer overflow in the `de265_image_get_buffer()` function in `image.cc`. When processing a crafted H.265 bitstream with large Sequence Parameter Set (SPS) dimensions and 16-bit bit depth, the calculation for the image plane allocation size (luma_height * luma_bpl) overflows a signed 32-bit integer. This results in a small memory allocation (approx. 1 KB). However, the subsequent `fill_image()` call uses `size_t` arithmetic to calculate the true size, leading to a massive (~4 GB) out-of-bounds write into the undersized heap buffer. The vulnerability is triggered when a user opens a malicious H.265 file. The issue is patched in version 1.1.0.
Affected products
- strukturag libde265 < 1.1.0
Timeline
- 2026-05-26: advisory: Original GitHub Security Advisory published
- 2026-06-19: disclosed: CVE published to NVD
- 2026-06-19: patched: Fix committed to repository