Description

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-11T22:16:38.083Z",
  "pubdate": "2026-09-11T22:16:38.083Z",
  "executiveSummary": "The libde265 HEVC decoder contains an integer overflow vulnerability due to the use of signed 32-bit arithmetic for calculating pixel offsets.\nThis vulnerability affects libde265 versions prior to 1.1.1 and poses a significant risk to memory safety.\nAn attacker can exploit this flaw by providing a maliciously crafted HEVC video stream containing specifically defined, large image dimensions.\nThe resulting integer overflow allows for out-of-bounds heap memory access, enabling potential remote code execution, arbitrary memory corruption, or information disclosure.\nThe impact is critical as it facilitates unauthorized data access and system instability by compromising the decoder process.\nExploitation requires no user authentication, as the vulnerability is triggered during the processing of a standard media stream.\nSuccessful exploitation depends on the attacker's ability to supply the crafted bitstream to an application utilizing the affected version of the libde265 library.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of arithmetic operations during the pixel offset calculation within the HEVC stream processing logic of libde265.\nSpecifically, the implementation utilizes signed 32-bit integer types to derive memory offsets based on image dimensions defined in the HEVC stream metadata.\nWhen an attacker provides a crafted HEVC stream that specifies extremely large image dimensions, the arithmetic calculation exceeds the maximum representable value of a signed 32-bit integer.\nThis overflow leads to a wrap-around, resulting in an incorrect, typically negative, or unexpectedly small integer value being used to allocate memory or index into heap buffers.\nThe attack flow commences when the decoder parses the malicious HEVC bitstream and attempts to reserve or index heap-allocated memory based on the overflowed offset value.\nSince the offset calculation is flawed, the pointer arithmetic directed at the heap buffer leads to out-of-bounds access, specifically heap-based buffer overflows or underflows.\nBy controlling the image dimensions in the bitstream, an attacker can manipulate the heap state to trigger reads from unauthorized memory locations or writes to unintended memory regions.\nThe scope of impact includes memory corruption which can lead to application crashes, potential disclosure of sensitive information residing in adjacent memory, or the redirection of execution flow if function pointers or control structures are overwritten within the heap.\nThis vulnerability is inherent to the library's internal decoding logic and is not dependent on external authentication or elevated privileges, making any application linked against libde265 versions below 1.1.1 inherently susceptible if they process untrusted HEVC media data.\nThe lack of bounds checking on the calculated offset during the memory management phase of the decoding process facilitates the memory corruption primitive required to escalate the vulnerability into a functional exploit."
}