CVE-2026-54241: libde265 heap buffer overflow in sample adaptive offset filter

CVE-2026-54241 · Severity: high · CVSS 7.4 · Published 2026-09-11

libde265 is a widely-used open-source H.265 video codec library used by popular media applications including VLC, GStreamer, and GNOME image viewers. A flaw in its sample adaptive offset filter allows a specially crafted video file to trigger an integer overflow, resulting in undersized memory allocation and out-of-bounds reading from the heap—potentially exposing sensitive data in decoded video output or crashing the application.

Quick answers

Is CVE-2026-54241 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54241 being exploited in the wild.
How severe is CVE-2026-54241?
High severity, with a CVSS score of 7.4, published 11 September 2026.
Which products and versions are affected?
strukturag libde265 prior to 1.1.1.
Is there a fix for CVE-2026-54241?
A patch was published on 2026-06-03: Version 1.1.1 contains patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54241 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54241?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the apply_sample_adaptive_offset_sequential() function in libde265/sao.cc, where a signed 32-bit integer overflow occurs when calculating the SAO input buffer size (stride × height × bytes_per_pixel). With large HEVC dimensions (e.g., 46341×46341 pixels at 16-bit color depth), this calculation wraps to a small positive value, causing undersized heap allocation. The SAO filter then performs reads using the actual (non-overflowed) stride value, reading up to ~4.3 GB past a ~625 KB buffer. Attack requires a crafted HEVC bitstream with specific SPS parameters, no user interaction or authentication. The fix widens the calculation to 64-bit (size_t). Patched in version 1.1.1.

Affected products

  • strukturag libde265 prior to 1.1.1

Timeline

  • 2026-06-03: disclosed: GitHub Security Advisory GHSA-j2qq-x2xq-g9wr published
  • 2026-09-11: advisory: CVE-2026-54241 published on NVD
  • 2026-06-03: patched: Version 1.1.1 contains patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.