CVE-2026-88373: libde265 NULL Pointer Dereference DoS Vulnerability

CVE-2026-88373 Overview

CVE-2026-88373 is a NULL pointer dereference vulnerability [CWE-476] in libde265, an open-source HEVC/H.265 video decoder library maintained by Struktur AG. The flaw exists in the Network Abstraction Layer (NAL) parsing path at commit 4d45a6b. When de265_push_NAL() receives a zero-length NAL unit, the resulting NAL_unit object retains a NULL backing buffer. That NULL pointer is then passed as the destination argument to memcpy() inside NAL_unit::set_data(). Even though the copy length is zero, passing a NULL pointer violates the nonnull requirement of memcpy() and triggers undefined behavior.

Critical Impact
Remote attackers can trigger process termination in UBSan-instrumented builds, causing denial of service in applications that decode untrusted HEVC streams through libde265.

Affected Products

libde265 at commit 4d45a6b (HEVC decoder library maintained by Struktur AG)
Downstream applications linking libde265 for HEVC/H.265 decoding
Builds instrumented with UndefinedBehaviorSanitizer (UBSan) that enforce nonnull attributes

Discovery Timeline

2026-09-24 - CVE-2026-88373 published to the National Vulnerability Database
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-88373

Vulnerability Analysis

The vulnerability resides in the NAL unit ingestion path exposed by the public API de265_push_NAL(). Callers submit NAL unit payloads to the decoder for subsequent parsing. The decoder constructs a NAL_unit object and copies the caller-supplied bytes into an internal backing buffer via NAL_unit::set_data(), which internally calls memcpy().

When a caller passes a zero-length NAL unit, the backing buffer is never allocated and remains NULL. The code still invokes memcpy(dest, src, 0) with a NULL destination. The C standard and the GCC/Clang nonnull attribute require both source and destination to be valid pointers regardless of the copy length. Compilers and sanitizers treat this as undefined behavior and abort the process.

The condition is reachable through any attacker-controlled HEVC bitstream delivered over the network, embedded in a container format, or supplied through a browser or media pipeline that links libde265.

Root Cause

The root cause is missing input validation for zero-length NAL units in de265_push_NAL() prior to invoking NAL_unit::set_data(). The library did not reject empty NAL headers nor skip the memcpy() call when the backing buffer was NULL. The upstream fix introduces a new error code, DE265_ERROR_INVALID_ARGUMENT, allowing the API to reject malformed input before reaching the vulnerable code path.

Attack Vector

An unauthenticated remote attacker can supply a crafted HEVC stream containing a zero-length NAL unit to any service or client application that decodes untrusted media with libde265. No user interaction beyond opening or receiving the media is required. The impact is limited to availability: the vulnerable process terminates, denying service to legitimate users.

// Patch excerpt: libde265/de265.h — new error code added upstream
   DE265_ERROR_UNSPECIFIED_DECODING_ERROR=18,
   DE265_ERROR_IMAGE_SIZE_EXCEEDS_SECURITY_LIMIT=19,
   DE265_ERROR_NAL_SIZE_EXCEEDS_SECURITY_LIMIT=20,
+  DE265_ERROR_INVALID_ARGUMENT=21,

   // --- errors that should become obsolete in later libde265 versions ---
// Source: https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea

Detection Methods for CVE-2026-88373

Indicators of Compromise

Repeated unexpected termination of processes linking libde265 while decoding attacker-supplied HEVC content
UBSan runtime diagnostics referencing null pointer passed as argument 1 in NAL_unit::set_data() or memcpy()
Core dumps or crash telemetry originating from de265_push_NAL() call frames
HEVC streams containing NAL units declared with a payload length of zero

Detection Strategies

Enable UBSan or AddressSanitizer in test builds of applications linking libde265 to surface the undefined behavior deterministically
Fuzz the de265_push_NAL() entry point with length-aware mutators that emit zero-length NAL units
Inspect inbound HEVC payloads at the gateway for malformed NAL headers before passing them to the decoder

Monitoring Recommendations

Monitor crash rates and segmentation faults for media services and client applications that process HEVC content
Collect application telemetry on return codes from de265_push_NAL() and alert on sudden spikes in decode errors
Review GitHub Issue Discussion #534 for reproduction details and track downstream package advisories

How to Mitigate CVE-2026-88373

Immediate Actions Required

Rebuild and redeploy libde265 using the upstream fix from the strukturag/libde265 security commit
Audit applications and services for direct or transitive dependencies on libde265 and prioritize patching of internet-facing media processors
Validate NAL unit lengths at the application layer before invoking de265_push_NAL() with untrusted input

Patch Information

The upstream fix validates the NAL header length passed through the public API and returns the new DE265_ERROR_INVALID_ARGUMENT status for malformed input. The patch is available in the GitHub commit f8d3249. Downstream distributions and applications bundling libde265 should rebuild against the fixed source tree.

Workarounds

Reject HEVC streams containing zero-length NAL units at the ingestion boundary
Isolate HEVC decoding in a sandboxed worker process so decoder crashes do not terminate the parent service
Disable HEVC decoding on exposed endpoints until the patched library is deployed

bash

# Build libde265 from the patched source
git clone https://github.com/strukturag/libde265.git
cd libde265
git checkout f8d324914e43d92af23614f22959cf9eee7bf9ea
./autogen.sh && ./configure && make && sudo make install