Description

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-11T22:16:38.223Z",
  "pubdate": "2026-09-11T22:16:38.223Z",
  "executiveSummary": "libde265 versions prior to 1.1.1 are susceptible to an integer overflow vulnerability arising from improper arithmetic operations during the calculation of sample adaptive offset input-buffer sizes.\nThe vulnerability occurs when processing HEVC streams containing specific large-dimension configurations and 16-bit luma samples, leading to an undersized heap allocation.\nThis flaw facilitates an out-of-bounds heap read, which can be exploited by an attacker to cause a service crash (Denial of Service) or potentially leak sensitive heap memory contents into the decoded video output.\nThe risk is critical for applications integrating libde265 to process untrusted HEVC media streams, as the exploitation is triggered through the consumption of a maliciously crafted bitstream without requiring authenticated access.\nSuccessful exploitation requires the victim to decode the malicious HEVC payload, making remote exploitation feasible in scenarios where the library handles incoming network-based video traffic.",
  "technicalDetails": "The vulnerability originates in the memory management logic responsible for calculating the buffer requirements for the Sample Adaptive Offset (SAO) filter within the libde265 codec. The implementation utilizes signed 32-bit arithmetic to determine the size of the input buffer required to hold SAO data.\nWhen a crafted HEVC stream specifies large video dimensions combined with 16-bit luma sample depth, the result of the size calculation exceeds the maximum value representable by a signed 32-bit integer. This triggers an integer overflow, causing the resulting value to wrap around to a smaller, incorrect positive integer.\nThe undersized integer is then passed to the heap allocation routine. Because the requested size is significantly smaller than the actual memory required to process the video frame, the subsequent read operations performed by the decoder during SAO processing exceed the boundaries of the allocated heap chunk.\nThe attack flow follows these steps: 1) The attacker constructs a malicious HEVC bitstream containing metadata that forces an integer overflow during the internal buffer calculation. 2) The attacker delivers this stream to an application utilizing libde265. 3) The library attempts to allocate the undersized buffer on the heap. 4) The decoder proceeds to read data into or from the buffer based on the original intended dimensions, not the constrained allocation size. 5) This out-of-bounds access results in a memory corruption event or the inclusion of adjacent heap memory in the decoded output buffer.\nThe impact includes the potential for information disclosure, where sensitive heap data—such as pointers, previous process states, or other media content—is leaked through the decoded frame output. Alternatively, the invalid memory access frequently triggers an access violation, leading to a termination of the decoding process and a crash. The vulnerability does not require prior authentication or elevated privileges, as it is inherently tied to the processing of the media stream itself."
}