strukturag libde265 up to 1.0.16 set_derived_values heap-based overflow

Summaryinfo

A vulnerability classified as critical has been found in strukturag libde265 up to 1.0.16. The affected element is the function pic_parameter_set::set_derived_values. The manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2026-33164. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in strukturag libde265 up to 1.0.16. This issue affects the function pic_parameter_set::set_derived_values. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is availability. The summary by CVE is:

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-33164 since 03/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 303275 (Linux Distros Unpatched Vulnerability : CVE-2026-33164), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.0.17 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the databases at Tenable (303275) and EUVD (EUVD-2026-13810). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• strukturag

Name

• libde265

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16

License

• open-source

Website

• Product: https://github.com/strukturag/libde265/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion