CVE-2026-45383 in libde265
Summary
by MITRE • 07/22/2026
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The heap buffer overflow vulnerability in libde265 versions prior to 1.0.19 represents a critical security flaw that affects the decoding process of h.265 video streams through improper bounds checking during Wavefront Parallel Processing slice handling. This vulnerability specifically manifests within the `decoder_context::decode_slice_unit_WPP()` function located in `libde265/decctx.cc`, where the software fails to validate the computed `ctbAddrRS` value against the allocated size of the `pps.CtbAddrRStoTS` array. The flaw occurs when processing WPP HEVC slices, which utilize a parallel processing approach to decode video frames more efficiently by breaking them into smaller units called coding tree blocks.
The technical implementation of this vulnerability stems from the mathematical computation of `ctbAddrRS` as `ctbRow * ctbsWidth` within the entry-point loop structure that governs slice decoding operations. When maliciously crafted PPS (Picture Parameter Set) and SPS (Sequence Parameter Set) headers are provided, these headers contain values that cause the calculated `ctbAddrRS` to exceed the bounds of the `pps.CtbAddrRStoTS` vector. This out-of-bounds read operation accesses memory locations beyond the allocated heap buffer, potentially leading to information disclosure, application crashes, or in more severe scenarios, arbitrary code execution depending on the memory layout and exploitation circumstances.
The operational impact of this vulnerability extends across various applications that utilize libde265 for video decoding, including media players, streaming services, content management systems, and any software infrastructure processing h.265 encoded video content. Attackers could exploit this flaw by crafting malicious video files or streams with specially designed parameter sets that trigger the buffer overflow condition during normal playback operations. The vulnerability's severity is compounded by the fact that it can be triggered through legitimate video decoding workflows without requiring special privileges, making it particularly dangerous in environments where users might encounter untrusted video content.
The mitigation strategy involves upgrading to libde265 version 1.0.19 or later, which implements proper bounds checking for the `ctbAddrRS` calculation against the `pps.CtbAddrRStoTS` array size. This fix aligns with industry best practices for memory safety and follows established security guidelines that emphasize input validation and boundary checking as fundamental defensive measures. From a cybersecurity perspective, this vulnerability maps to CWE-125 (Out-of-bounds Read) and can be categorized under ATT&CK technique T1203 (Exploitation for Client Execution) when leveraged in media player exploitation scenarios. Organizations should also implement additional security controls such as sandboxing video processing components, validating input streams through multiple layers of verification, and monitoring for anomalous decoding behaviors that might indicate exploitation attempts.
The vulnerability demonstrates the importance of robust parameter validation in multimedia codecs where malformed headers can lead to memory corruption issues. It highlights the need for comprehensive testing of edge cases in codec implementations and proper integration of security-focused tools like AddressSanitizer during development cycles to identify such buffer overflow conditions before deployment in production environments. The fix implemented in version 1.0.19 serves as a model for how parameter validation should be applied consistently throughout the decoding pipeline, particularly in areas where mathematical computations are used to calculate array indices and memory access patterns.