CVE-2026-45382 Overview
CVE-2026-45382 is an out-of-bounds read vulnerability [CWE-125] in libde265, an open source implementation of the H.265 (HEVC) video codec. The flaw resides in decoder_context::decode_slice_unit_tiles at libde265/decctx.cc:920. The function reads pps.CtbAddrRStoTS[ctbAddrRS] without validating the computed index against the allocated array size. A malformed Picture Parameter Set (PPS) that passes set_derived_values but encodes geometry inconsistent with the Sequence Parameter Set (SPS) produces an index past the allocation. This results in a 4-byte heap-buffer-overflow READ. Version 1.0.19 resolves the issue.
Critical Impact
Processing a crafted H.265 stream triggers a heap-buffer-overflow read, potentially causing memory disclosure or process crash in applications that link libde265.
Affected Products
- libde265 versions prior to 1.0.19
- Applications and media pipelines linking vulnerable libde265 releases
- H.265/HEVC decoding workflows built on strukturag/libde265
Discovery Timeline
- 2026-07-21 - CVE-2026-45382 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-45382
Vulnerability Analysis
The vulnerability affects the tile decoding path in libde265. At line 966 of decctx.cc, the decoder computes ctbAddrRS = ctbY * ctbsWidth + ctbX using colBd[] and rowBd[] arrays supplied by the PPS. The code then indexes pps.CtbAddrRStoTS[ctbAddrRS] without confirming that ctbAddrRS remains within CtbAddrRStoTS.size(), which should equal sps->PicSizeInCtbsY. When PPS geometry disagrees with SPS-derived picture dimensions, the index exceeds the allocation. The result is a 4-byte read outside the intended heap buffer, categorized under [CWE-125] Out-of-Bounds Read.
Root Cause
The root cause is missing cross-validation between PPS-supplied tile geometry and SPS-derived picture dimensions. The set_derived_values routine accepts PPS values that individually appear valid but combine into a Coordinate Tree Block (CTB) raster address exceeding the allocated CtbAddrRStoTS table. No bounds check gates the subsequent lookup.
Attack Vector
An attacker crafts a malicious H.265 bitstream containing inconsistent PPS and SPS parameters. When a vulnerable application decodes the stream, the decoder computes an out-of-range CTB address and reads past the allocated buffer. Delivery vectors include media files, streaming content, browser video pipelines, and any network-facing service that decodes untrusted H.265 input. Successful exploitation leaks 4 bytes of adjacent heap memory or crashes the decoder process.
See the GitHub Security Advisory for the upstream analysis and patch commit.
Detection Methods for CVE-2026-45382
Indicators of Compromise
- Crashes or abnormal termination in processes linking libde265.so when handling untrusted H.265 content
- AddressSanitizer or memory-safety tooling reporting heap-buffer-overflow READ in decoder_context::decode_slice_unit_tiles
- H.265 files or streams containing PPS colBd[]/rowBd[] values inconsistent with SPS picture dimensions
Detection Strategies
- Inventory software that statically or dynamically links libde265 and identify installed versions below 1.0.19
- Run fuzzing or sanitizer-instrumented builds of media pipelines against untrusted HEVC samples to surface the overflow
- Monitor application telemetry for repeated decoder crashes correlated with video ingestion endpoints
Monitoring Recommendations
- Log and alert on unexpected exits or segmentation faults in processes handling H.265 content
- Track file hashes and origins of media processed by server-side transcoding services
- Correlate crash telemetry with network sources of decoded content to identify hostile inputs
How to Mitigate CVE-2026-45382
Immediate Actions Required
- Upgrade libde265 to version 1.0.19 or later in all builds, containers, and distribution packages
- Rebuild and redeploy applications that statically link libde265 against the patched release
- Restrict processing of untrusted H.265 streams until the upgrade is confirmed across the environment
Patch Information
libde265 version 1.0.19 fixes CVE-2026-45382 by validating the CTB raster address against CtbAddrRStoTS.size() before dereferencing. Refer to the GitHub Security Advisory GHSA-hwhx-x2mq-ccr9 for commit references and release notes.
Workarounds
- Sandbox H.265 decoding in isolated processes or containers with minimal privileges to contain memory disclosure
- Validate media provenance and reject H.265 inputs from untrusted sources where feasible
- Disable H.265 decoding paths in exposed services until the patched library is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
