CVE-2026-45382: libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles (libde265/decctx.cc:920) reads pps.CtbAddrRStoTS[ctbAddrRS] at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd[]/rowBd[] arrays without validating the result against CtbAddrRStoTS.size() == sps->PicSizeInCtbsY. A malformed PPS that passes setderivedvalues but encodes geometry inconsistent with the SPS produces a ctbAddrRS past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libde265to a version that resolves this vulnerability.Fixed in 1.0.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45382?
CVE-2026-45382 has a medium severity rating of 6.9.
How do I fix CVE-2026-45382?
To fix CVE-2026-45382, update to libde265 version 1.0.19 or later.
What type of vulnerability is CVE-2026-45382?
CVE-2026-45382 is classified as a heap-buffer-overflow vulnerability.
What is affected by CVE-2026-45382?
CVE-2026-45382 affects the libde265 library, which is an implementation of the h.265 video codec.
When was CVE-2026-45382 published?
CVE-2026-45382 was published on July 21, 2026.