CVE-2026-45383: libde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 <= v1.0.18
Last updated 17 July 2026
Other sources
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in decodercontext::decodesliceunitWPP() in libde265/decctx.cc. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, ctbAddrRS is computed as ctbRow ctbsWidth inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds pps.CtbAddrRStoTS.size(), the subsequent array access pps.CtbAddrRStoTS[ctbAddrRS] reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libde265to a version that resolves this vulnerability.Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1 - Upgrade
Upgrade
libde265to a version that resolves this vulnerability.Fixed in 1.0.19
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using libde265 versions prior to 1.0.19 are affected when they decode HEVC content containing a WPP slice. The affected code is in the HEVC decoder's WPP slice handling.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted HEVC bitstream whose PPS/SPS headers cause the computed ctbAddrRS value to exceed the CtbAddrRStoTS array size during WPP slice decoding. No privileges or user interaction are required according to the supplied vector.
Are default installations affected?
The available information identifies affected versions and the WPP decoding path, but does not state whether WPP decoding is enabled or reachable in a default configuration.
What is the remediation?
Update libde265 to version 1.0.19, which patches the out-of-bounds read. If updating is not immediately possible, the provided information does not document a supported mitigation.
How can I determine whether I am affected?
Check the installed libde265 version. Versions earlier than 1.0.19 are affected; version 1.0.19 contains the fix.