Skip to content
OpenAdvisories
High · 7.4 CVE-2026-54240 EUVD-2026-76760

libde265: Pixel accessor signed integer overflow causes heap OOB read/write

Published Sep 11, 2026 · Updated Sep 14, 2026 · Assigned by GitHub_M

Description

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

Affected products

VendorProductAffectedFixed
strukturag libde265 < 1.1.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libde265 1.1.1-1 —
Debian 13 libde265 1.0.15-1+deb13u1 —
Debian 12 libde265 1.0.11-1+deb12u3 —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 libde265 No fix yet —
Ubuntu 24.04 LTS libde265 1.0.15-1ubuntu0.1 USN-8573-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS libde265 1.0.16-1ubuntu0.1~esm1 USN-8573-1
Ubuntu Pro 22.04 LTS libde265 1.0.8-1ubuntu0.3+esm2 USN-8573-1
Ubuntu Pro 20.04 LTS libde265 1.0.4-1ubuntu0.4+esm2 USN-8573-1
Ubuntu Pro 18.04 LTS libde265 1.0.2-2ubuntu0.18.04.1~esm6 USN-8573-1
Ubuntu Pro 16.04 LTS libde265 1.0.2-2ubuntu0.16.04.1~esm6 USN-8573-1
ReleasePackageFixed inAdvisory
Alpine v3.24 libde265 1.1.3-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libde265 +1 1.0.18-1.amzn2023.0.3 ALAS2023-2026-1974

Advisories 2

References