Summary
It was discovered that libde265 did not properly validate certain crafted
H.265 bitstreams, leading to a NULL pointer dereference. An attacker could
possibly use this issue to cause libde265 to crash, resulting in a denial
of service.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | libde265 | 1.0.15-1ubuntu0.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libde265 | 1.0.2-2ubuntu0.16.04.1~esm7 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libde265 | 1.0.2-2ubuntu0.18.04.1~esm7 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libde265 | 1.0.4-1ubuntu0.4+esm3 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libde265 | 1.0.8-1ubuntu0.3+esm3 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | libde265 | 1.0.16-1ubuntu0.1~esm2 |
Vulnerabilities 1
-
High 7.5
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL(…
References
-
report
https://ubuntu.com/security/CVE-2026-88373