Executive brief
libde265 is a video decoder library used to play HEVC/H.265 video files. A vulnerability in how it calculates memory addresses for pixel data can be exploited by crafting a malicious video file, allowing an attacker to read sensitive data from memory, corrupt the decoder's heap memory, or crash the application. This could impact media playback systems, video streaming services, and any application that uses this library to decode video.
Technical details
The vulnerability is a signed integer overflow in the pixel accessor functions (get_image_plane_at_pos and variants) in libde265/image.h. These functions compute pixel offsets using signed 32-bit arithmetic: ypos * stride. For HEVC streams with dimensions exceeding ~46,341 pixels, the multiplication overflows to a negative value, causing subsequent pointer arithmetic to reference memory before the buffer start. An attacker can craft a malicious HEVC bitstream with large image dimensions (e.g., 46341×46341 pixels, which bypass existing ≤65535 validation) to trigger out-of-bounds heap reads during decoding, leaking heap data or corrupting memory used by PCM output, transform coefficients, and motion compensation. The fix widens the arithmetic to size_t or int64_t. Patch available in version 1.1.1.
Affected products
- strukturag libde265 < 1.1.1
Timeline
- 2026-06-03: disclosed: GHSA advisory published
- 2026: patched: Fix available in version 1.1.1
- 2026-09-11: advisory: CVE-2026-54240 published