strukturag libde265 up to 1.0.18 Decoder Context libde265/decctx.cc decode_slice_unit_tiles colBd/rowBd heap-based overflow

Summaryinfo

A vulnerability classified as critical has been found in strukturag libde265 up to 1.0.18. The affected element is the function decoder_context::decode_slice_unit_tiles of the file libde265/decctx.cc of the component Decoder Context. This manipulation of the argument colBd/rowBd causes heap-based overflow. The identification of this vulnerability is CVE-2026-45382. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical was found in strukturag libde265 up to 1.0.18. Affected by this vulnerability is the function decoder_context::decode_slice_unit_tiles of the file libde265/decctx.cc of the component Decoder Context. The manipulation of the argument colBd/rowBd with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-45382 since 05/12/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.0.19 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• strukturag

Name

• libde265

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18

License

• open-source

Website

• Product: https://github.com/strukturag/libde265/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion