CVE-2024-38950: Struktur Libde265 Buffer Overflow Vulnerability

CVE-2024-38950 Overview

CVE-2024-38950 is a heap buffer overflow vulnerability in libde265 version 1.0.15, an open-source H.265/HEVC video decoder maintained by struktur AG. The flaw resides in the __interceptor_memcpy function path and can be triggered by a crafted media payload. When a vulnerable application decodes the malicious input, the out-of-bounds heap write causes the process to crash, producing a denial-of-service condition. The vulnerability is categorized under [CWE-122] (Heap-based Buffer Overflow) and requires user interaction to load or open the malicious file.

Critical Impact
Attackers can crash any application linked against libde265 1.0.15 by delivering a crafted HEVC payload, resulting in loss of availability for media processing workloads.

Affected Products

struktur libde265 version 1.0.15
Applications and media pipelines statically or dynamically linked against the affected libde265 release
Downstream distributions repackaging libde265 1.0.15 without backported fixes

Discovery Timeline

2024-06-26 - CVE-2024-38950 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38950

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside the HEVC decoding routines of libde265 1.0.15. During processing of a specially crafted bitstream, the decoder invokes memcpy with a length that exceeds the size of the destination heap allocation. Address sanitizer instrumentation surfaces the fault at __interceptor_memcpy, indicating the copy operates on attacker-influenced data past the intended buffer boundary.

Because libde265 is embedded in media players, transcoders, browsers, and server-side conversion tools, any component that decodes untrusted HEVC input inherits this exposure. Successful exploitation crashes the host process. Confidentiality and integrity are not directly affected based on the assigned scoring, but availability of the decoding service is disrupted.

Root Cause

The root cause is missing or insufficient validation of size or bounds parameters extracted from the HEVC bitstream before they are passed to memcpy. The decoder trusts attacker-controlled length or offset values, leading to a heap out-of-bounds write. See GitHub Issue #460 for the reproducer and stack trace.

Attack Vector

Exploitation requires an attacker to deliver a crafted HEVC file or stream to a target application that uses libde265 1.0.15 for decoding. User interaction is required, typically opening the file or navigating to attacker-controlled media. No authentication is required, and the attack is deliverable over the network via any channel capable of transporting media (email attachment, web download, streaming endpoint).

No verified public exploit code is available. Additional context is tracked in the CVE-2024-38950 research repository.

Detection Methods for CVE-2024-38950

Indicators of Compromise

Repeated crashes or segmentation faults in processes that load libde265.so or libde265.dll
AddressSanitizer or crash-dump entries referencing __interceptor_memcpy within libde265 call frames
HEVC media files originating from untrusted sources that fail to decode and terminate the host process

Detection Strategies

Inventory endpoints and servers running applications that bundle libde265 1.0.15 and flag any version prior to a patched release
Monitor application crash telemetry for media decoders, browsers, and transcoding services for unexpected termination during HEVC parsing
Deploy file-content inspection at ingress points to identify malformed HEVC streams targeting decoder logic

Monitoring Recommendations

Enable operating-system crash reporting (Windows Error Reporting, macOS ReportCrash, Linux systemd-coredump) and forward events to centralized logging
Alert on repeated crashes of the same media-handling process within a short interval, which can indicate exploitation attempts
Track software composition analysis (SCA) findings that report libde265 1.0.15 in build manifests and container images

How to Mitigate CVE-2024-38950

Immediate Actions Required

Identify all systems and applications that ship or link against libde265 1.0.15 using SCA tooling and package inventories
Restrict processing of HEVC content from untrusted sources until an updated library is deployed
Isolate server-side transcoding workloads behind sandboxed workers so a crash does not affect the parent service

Patch Information

No vendor advisory URL is listed in the NVD record at time of writing. Consult the upstream project at libde265 GitHub Issue #460 for remediation status and updated releases beyond 1.0.15. Rebuild dependent applications against the fixed version once available.

Workarounds

Disable HEVC decoding in applications where the codec is not required
Run media decoders inside sandboxed or containerized processes with resource limits and automatic restart policies
Validate and filter media uploads at application ingress, rejecting malformed HEVC streams before they reach the decoder

bash

# Configuration example: identify vulnerable libde265 installations on Linux
dpkg -l | grep libde265
find / -name 'libde265*' -type f 2>/dev/null -exec sh -c 'strings "$1" | grep -m1 "1.0.15" && echo "Vulnerable: $1"' _ {} \;