CVE-2026-33165: heap out-of-bounds write in libde265 1.0.16
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctbinfo.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing setSliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33165?
CVE-2026-33165 has a severity level classified as high due to the potential for remote code execution through a crafted HEVC bitstream.
How do I fix CVE-2026-33165?
To mitigate CVE-2026-33165, upgrade libde265 to version 1.0.17 or later immediately.
What does CVE-2026-33165 affect?
CVE-2026-33165 affects libde265 versions prior to 1.0.17, which is an implementation of the h.265 video codec.
What type of vulnerability is CVE-2026-33165?
CVE-2026-33165 is classified as a heap out-of-bounds write vulnerability.
How can CVE-2026-33165 be triggered?
CVE-2026-33165 can be triggered by a crafted HEVC bitstream that leads to an out-of-bounds write due to stale ctb_info.log2unitSize.