CVE-2026-54241: libde265 HEVC Decoder Information Disclosure

CVE-2026-54241 Overview

CVE-2026-54241 is a heap-based buffer vulnerability in libde265, an open source implementation of the H.265/HEVC video codec. Versions prior to 1.1.1 calculate the sample adaptive offset (SAO) input-buffer size using signed 32-bit arithmetic. A crafted HEVC stream containing large dimensions and 16-bit luma samples triggers an integer overflow, producing an undersized allocation and a subsequent out-of-bounds heap read. Exploitation can expose heap data through decoded output or crash the decoder process. The maintainers released a patch in libde265 version 1.1.1.

Critical Impact
Remote attackers can leak heap memory contents or crash any application that decodes attacker-supplied HEVC video with a vulnerable libde265 build.

Affected Products

libde265 versions prior to 1.1.1
Applications and libraries that embed libde265 for HEVC decoding
Media pipelines, browsers, and image viewers that process HEIF/HEIC content via libde265

Discovery Timeline

2026-09-11 - CVE-2026-54241 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54241

Vulnerability Analysis

The flaw resides in the SAO (Sample Adaptive Offset) input-buffer size computation within libde265. The routine multiplies frame dimensions and per-sample byte counts using signed 32-bit integers. When a decoder processes an HEVC stream declaring large luma and chroma dimensions with 16-bit samples, the multiplication overflows the int32_t result. libde265 then allocates a buffer smaller than the data the decoder later writes and reads during SAO filtering.

Downstream code assumes the allocation matches the geometry advertised in the stream. It reads past the end of the undersized heap allocation, producing an out-of-bounds heap read classified under [CWE-122]. The out-of-bounds bytes can be copied into decoded frames returned to the caller, effectively leaking adjacent heap contents. Corrupted decoder state can also terminate the host process.

Root Cause

The root cause is unchecked signed integer arithmetic during buffer sizing. The product of width * height * bytes_per_sample exceeds INT32_MAX for high-resolution 16-bit streams. The result wraps to a small or negative value, and the allocator returns a buffer that cannot hold the SAO input plane.

Attack Vector

An attacker delivers a crafted HEVC bitstream to any application that decodes untrusted video through libde265. Delivery paths include web pages serving HEIF images, email attachments, chat clients, and media servers. No authentication or user interaction beyond opening the media is required, though the specific stream parameters raise attack complexity.

The vulnerability is described in prose because no verified proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-j2qq-x2xq-g9wr for maintainer analysis.

Detection Methods for CVE-2026-54241

Indicators of Compromise

Unexpected crashes in processes that load libde265.so or libde265.dll when handling HEVC or HEIF content
Decoded frames containing visible artifacts or noise blocks consistent with uninitialized heap contents
Anomalous HEVC streams declaring very large picture dimensions combined with 10-bit or higher luma bit depth

Detection Strategies

Inventory installed libde265 versions and flag any build older than 1.1.1
Monitor endpoint telemetry for repeated segmentation faults or heap corruption reports from media-handling processes
Instrument decoders with AddressSanitizer in test environments to surface heap out-of-bounds reads on suspect samples

Monitoring Recommendations

Log HEVC decoder failures and correlate them with the source of the media file
Alert on media-handling processes making unexpected network callbacks after processing untrusted HEVC content
Track file-format telemetry for HEIC and HEVC payloads arriving from external senders

How to Mitigate CVE-2026-54241

Immediate Actions Required

Upgrade libde265 to version 1.1.1 or later across all systems and container images
Rebuild and redeploy downstream applications, browsers, and libraries that statically link libde265
Restrict decoding of HEVC and HEIF content from untrusted sources until patched builds are deployed

Patch Information

libde265 version 1.1.1 contains the fix. The patch corrects the SAO input-buffer sizing arithmetic so that large-dimension, 16-bit streams no longer overflow the signed 32-bit calculation. Details are available in the GitHub Security Advisory GHSA-j2qq-x2xq-g9wr.

Workarounds

Disable HEVC and HEIF decoding paths in applications that do not require them
Sandbox media decoding processes to limit the impact of memory disclosure or crashes
Filter inbound media at gateways and reject HEVC streams with implausibly large declared dimensions

bash

# Verify installed libde265 version on Linux
dpkg -l | grep libde265
# or
pkg-config --modversion libde265

# Upgrade on Debian/Ubuntu once distro packages are updated
sudo apt-get update && sudo apt-get install --only-upgrade libde265-0