# CVE-2026-54240: libde265 integer overflow in pixel accessor

Source: https://junglewise.ai/threats/cve-2026-54240-libde265-integer-overflow-in-pixel-accessor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54240 · Severity: high · CVSS 7.4 · Published 2026-09-11

libde265 is a video decoder library used to play HEVC/H.265 video files. A vulnerability in how it calculates memory addresses for pixel data can be exploited by crafting a malicious video file, allowing an attacker to read sensitive data from memory, corrupt the decoder's heap memory, or crash the application. This could impact media playback systems, video streaming services, and any application that uses this library to decode video.

## Quick answers

**Is CVE-2026-54240 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54240 being exploited in the wild.

**How severe is CVE-2026-54240?** High severity, with a CVSS score of 7.4, published 11 September 2026.

**Which products and versions are affected?** strukturag libde265 < 1.1.1.

**Is there a fix for CVE-2026-54240?** A patch was published on 2026: Fix available in version 1.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54240 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54240?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a signed integer overflow in the pixel accessor functions (get_image_plane_at_pos and variants) in libde265/image.h. These functions compute pixel offsets using signed 32-bit arithmetic: ypos * stride. For HEVC streams with dimensions exceeding ~46,341 pixels, the multiplication overflows to a negative value, causing subsequent pointer arithmetic to reference memory before the buffer start. An attacker can craft a malicious HEVC bitstream with large image dimensions (e.g., 46341×46341 pixels, which bypass existing ≤65535 validation) to trigger out-of-bounds heap reads during decoding, leaking heap data or corrupting memory used by PCM output, transform coefficients, and motion compensation. The fix widens the arithmetic to size_t or int64_t. Patch available in version 1.1.1.

## Affected products

- strukturag libde265 < 1.1.1

## Timeline

- 2026-06-03: disclosed: GHSA advisory published
- 2026: patched: Fix available in version 1.1.1
- 2026-09-11: advisory: CVE-2026-54240 published

## References

- [https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3](https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3)