CVE-2026-88373 in libde265
Summary
by MITRE • 09/24/2026
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in libde265 commit 4d45a6b represents a critical memory safety flaw within the Network Abstraction Layer parsing logic. This specific defect manifests as a NULL pointer dereference that occurs during the processing of video data streams, particularly when handling malformed or edge-case input files. The root cause lies in how the library initializes and manages buffer pointers for NAL units. When the function de265_push_NAL is invoked with a zero-length NAL unit payload, the internal logic fails to properly initialize the backing buffer pointer within the resulting NAL_unit structure. Consequently, this structure retains a NULL value for its data buffer field rather than an empty but valid memory address or a safely handled null state that prevents subsequent unsafe operations.
The operational impact of this flaw becomes apparent when the library attempts to process the malformed unit further down the pipeline. Specifically, within the NAL_unit::set_data method, the code invokes memcpy() using the potentially NULL backing buffer as the destination argument. Although the length parameter passed to memcpy is zero, which theoretically should result in no memory access according to some interpretations of C standards regarding empty copies, many compiler implementations and static analysis tools treat passing a NULL pointer to memcpy as undefined behavior regardless of size. This violation triggers immediate process termination when running under UndefinedBehaviorSanitizer instrumentation or similar debugging environments that enforce strict adherence to language specifications. In production builds without such sanitizers, the outcome may vary from silent corruption to segmentation faults, leading to application crashes and denial of service conditions for any software relying on libde265 for video decoding tasks.
From a security classification perspective, this vulnerability aligns with CWE-476 NULL Pointer Dereference, as it involves accessing memory through an uninitialized or invalid pointer value. The attack vector typically falls under CWE-20 Improper Input Validation because the library does not adequately validate or sanitize incoming NAL unit lengths before processing them into internal structures. In terms of adversary tactics, this flaw can be leveraged within the MITRE ATT&CK framework as part of an Initial Access technique where a maliciously crafted video file is used to crash a vulnerable media player or streaming service, potentially serving as a precursor for more complex exploitation if combined with other memory corruption bugs in adjacent code paths. The denial of service aspect allows attackers to disrupt availability by simply providing a specially constructed HEVC/H.265 stream containing zero-length NAL units at critical parsing points.
Mitigation strategies must focus on strengthening input validation and improving defensive coding practices within the library's core modules. Developers should implement explicit checks for NULL pointers before any memory operation, even if the size is zero, to ensure compliance with strict safety standards. Additionally, modifying de265_push_NAL to allocate a minimal valid buffer or explicitly handle empty payloads by skipping further processing steps would prevent the propagation of invalid state into downstream functions like set_data. Updating libde265 to include this patch ensures that edge cases involving zero-length data are handled gracefully without triggering undefined behavior. Organizations deploying applications dependent on this library should prioritize immediate updates and consider implementing runtime monitoring or sandboxing mechanisms to isolate potential crashes from affecting critical system services.