CVE-2026-45383: libde265 Buffer Overflow Vulnerability

CVE-2026-45383 Overview

CVE-2026-45383 is an out-of-bounds read vulnerability [CWE-125] in libde265, an open source implementation of the H.265/HEVC video codec maintained by struktur AG. The flaw resides in the decoder_context::decode_slice_unit_WPP() function in libde265/decctx.cc. When decoding a Wavefront Parallel Processing (WPP) HEVC slice, a crafted Picture Parameter Set (PPS) or Sequence Parameter Set (SPS) header can force an array index that exceeds the size of pps.CtbAddrRStoTS, resulting in a heap buffer overflow read confirmed by AddressSanitizer. Versions prior to 1.0.19 are affected. Version 1.0.19 contains the fix.

Critical Impact
A remote attacker can trigger a heap out-of-bounds read by supplying a malformed HEVC video stream, causing information disclosure or process crash in any application that links libde265.

Affected Products

libde265 versions prior to 1.0.19
Applications and media players linking vulnerable libde265 builds for HEVC decoding
Downstream distributions and container images bundling libde265 < 1.0.19

Discovery Timeline

2026-07-21 - CVE-2026-45383 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-45383

Vulnerability Analysis

The vulnerability affects the WPP slice decoding path in libde265. Inside the entry-point loop of decoder_context::decode_slice_unit_WPP(), the code computes the raster-scan coding tree block address as ctbAddrRS = ctbRow * ctbsWidth. This value is then used as an index into the pps.CtbAddrRStoTS vector, which maps raster-scan addresses to tile-scan addresses.

The decoder does not validate that ctbAddrRS remains within the bounds of pps.CtbAddrRStoTS.size() before dereferencing the vector. When a maliciously crafted bitstream declares PPS or SPS parameters that yield a ctbRow * ctbsWidth product larger than the allocated table, the access pps.CtbAddrRStoTS[ctbAddrRS] reads past the end of the heap allocation.

Root Cause

The root cause is missing bounds validation between the header-declared picture geometry and the size of the CTB address translation table. AddressSanitizer confirmed the heap-buffer-overflow read during fuzz testing of malformed HEVC input. The mismatch stems from trusting attacker-controlled header fields without cross-checking derived values against the size of vectors initialized elsewhere in PPS setup.

Attack Vector

Exploitation requires an attacker to deliver a crafted HEVC video file or stream to an application that uses libde265 for decoding. No authentication or user interaction is required beyond opening or previewing the file. Typical delivery paths include email attachments, web page embeds, and automated media processing pipelines that transcode uploaded content.

The primary impact is availability loss through process crash. Depending on how the calling application handles adjacent heap memory, the out-of-bounds read may also leak sensitive process memory to the attacker. See the GitHub Security Advisory GHSA-wg9q-ppqw-6q38 for the upstream technical description.

Detection Methods for CVE-2026-45383

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking libde265.so when parsing HEVC content
AddressSanitizer reports referencing decode_slice_unit_WPP or CtbAddrRStoTS in stack traces
HEVC files with anomalous PPS/SPS parameter combinations producing large ctbRow * ctbsWidth values relative to picture size

Detection Strategies

Inventory all endpoints, servers, and container images shipping libde265 versions below 1.0.19 using software composition analysis tooling
Enable AddressSanitizer or equivalent runtime memory checkers on media processing services in staging environments to surface exploitation attempts
Fuzz-test HEVC ingestion endpoints with malformed PPS/SPS headers to validate defensive parsing before deployment

Monitoring Recommendations

Alert on repeated crashes of media players, transcoders, or thumbnailers correlated with HEVC file ingestion
Log and review media file uploads from untrusted sources, retaining samples that trigger decoder failures for forensic analysis
Monitor package manifests and container image scans for libde265 versions prior to 1.0.19

How to Mitigate CVE-2026-45383

Immediate Actions Required

Upgrade libde265 to version 1.0.19 or later across all systems, container images, and application bundles
Rebuild and redeploy downstream software that statically links libde265 after updating the dependency
Restrict processing of HEVC content from untrusted sources until patched builds are rolled out

Patch Information

Version 1.0.19 of libde265 patches the vulnerability by adding proper bounds validation before the pps.CtbAddrRStoTS[ctbAddrRS] access. Obtain the fixed release from the libde265 GitHub repository and refer to the GHSA-wg9q-ppqw-6q38 advisory for commit-level details.

Workarounds

Disable HEVC decoding in applications that do not require it until the patched library is deployed
Sandbox media processing workloads using seccomp, AppArmor, or container isolation to contain crashes and limit memory disclosure
Pre-validate incoming HEVC files with a hardened parser or reject files exceeding expected size and geometry constraints

bash

# Verify installed libde265 version on Debian/Ubuntu systems
dpkg -l | grep libde265

# Upgrade to a patched release
sudo apt-get update && sudo apt-get install --only-upgrade libde265-0

# Confirm the runtime version linked by an application
ldd /usr/bin/your-media-app | grep libde265