Summary
It was discovered that libde265 did not properly manage memory under
certain circumstances. An attacker could possibly use this issue to
cause libde265 to crash, resulting in a denial of service. This issue
only affected Ubuntu 22.04 LTS. (CVE-2023-51792)
It was discovered that libde265 did not properly handle certain
malformed media files, leading to a heap buffer overflow. An attacker
could possibly use this issue to cause libde265 to crash, resulting in
a denial of service. (CVE-2024-38949, CVE-2024-38950)
It was discovered that libde265 did not properly handle certain
malformed input, leading to a segmentation fault. An attacker could
possibly use this issue to cause libde265 to crash, resulting in a
denial of service. (CVE-2025-61147)
It was discovered that libde265 did not properly handle a malformed
H.265 PPS NAL unit, leading to a segmentation fault. An attacker could
possibly use this issue to cause libde265 to crash, resulting in a
denial of service. (CVE-2026-33164)
It was discovered that libde265 did not properly handle certain
crafted HEVC bitstreams, leading to an out-of-bounds write. An attacker
could possibly use this issue to cause libde265 to crash, resulting in
a denial of service. (CVE-2026-33165)
Valentin Mercier discovered that libde265 did not properly validate
tile geometry when handling crafted media files, leading to an
out-of-bounds read. An attacker could possibly use this issue to cause
libde265 to crash, resulting in a denial of service, or to obtain
sensitive information. (CVE-2026-45382)
It was discovered that libde265 did not properly validate certain
values when decoding crafted media files, leading to an out-of-bounds
read. An attacker could possibly use this issue to cause libde265 to
crash, resulting in a denial of service, or to obtain sensitive
information. (CVE-2026-45383)
Ying Dong discovered that libde265 did not properly validate reference
picture set entries when handling a crafted H.265 bitstream, leading to
an out-of-bounds write. An attacker could possibly use this issue to
cause libde265 to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2026-49295)
Ying Dong discovered that libde265 did not properly manage memory when
handling a crafted sequence of H.265 NAL units, leading to excessive
memory consumption. An attacker could possibly use this issue to cause
libde265 to use excessive resources, leading to a denial of service.
(CVE-2026-49337)
Ying Dong discovered that libde265 did not properly handle certain
crafted H.265 bitstreams with large dimensions, leading to a heap
buffer overflow. An attacker could possibly use this issue to cause
libde265 to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2026-49346)
It was discovered that libde265 did not properly handle certain crafted
HEVC bitstreams with large dimensions, leading to an out-of-bounds
read and write. An attacker could possibly use this issue to cause
libde265 to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2026-54240)
It was discovered that libde265 did not properly handle certain crafted
HEVC bitstreams with large dimensions, leading to a heap buffer
overflow. An attacker could possibly use this issue to cause libde265
to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-54241)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | libde265 | 1.0.15-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libde265 | 1.0.2-2ubuntu0.16.04.1~esm6 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libde265 | 1.0.2-2ubuntu0.18.04.1~esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libde265 | 1.0.4-1ubuntu0.4+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libde265 | 1.0.8-1ubuntu0.3+esm2 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | libde265 | 1.0.16-1ubuntu0.1~esm1 |
Vulnerabilities 12
-
High 8.7
NULL Pointer Dereference in libde265
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.
-
High 7.4
libde265: Pixel accessor signed integer overflow causes heap OOB read/write
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bou…
-
High 7.4
libde265: SAO sequential filter heap buffer overflow via signed integer overflow
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to…
-
High 7.1
libde265 has an out-of-bounds write in process_reference_picture_set via predicted short-term RPS
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is …
-
High 7.1
libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The …
-
Medium 6.9
libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is co…
-
Medium 6.9
libde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 <= v1.0.18
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel…
-
Medium 6.5
Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to…
-
Medium 6.5
Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to…
-
Medium 6.2
strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::com…
-
Medium 5.5
heap out-of-bounds write in libde265 1.0.16
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicW…
-
Medium 4.3
libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that …
References
-
report
https://ubuntu.com/security/CVE-2024-38949
-
report
https://ubuntu.com/security/CVE-2024-38950
-
report
https://ubuntu.com/security/CVE-2025-61147
-
report
https://ubuntu.com/security/CVE-2026-33164
-
report
https://ubuntu.com/security/CVE-2026-33165
-
report
https://ubuntu.com/security/CVE-2026-45382
-
report
https://ubuntu.com/security/CVE-2026-45383
-
report
https://ubuntu.com/security/CVE-2026-49295
-
report
https://ubuntu.com/security/CVE-2026-49337
-
report
https://ubuntu.com/security/CVE-2026-49346
-
report
https://ubuntu.com/security/CVE-2026-54240
-
report
https://ubuntu.com/security/CVE-2026-54241