CVE-2026-54240: libde265: Pixel accessor signed integer overflow causes heap OOB read/write
Last updated 1 July 2026
Other sources
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libde265to a version that resolves this vulnerability.Fixed in 1.1.1-1 - Upgrade
Upgrade
libde265to a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
Which installations are affected?
Installations using libde265 versions earlier than 1.1.1 are affected. Version 1.1.1 contains the patch.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted HEVC stream with large image dimensions to a vulnerable decoder. The supplied vector indicates network reachability, no required privileges, and no user interaction.
How can I determine whether I am exposed?
Check the installed libde265 version and whether the application processes HEVC streams. Versions prior to 1.1.1 that decode attacker-controlled or otherwise untrusted HEVC content are exposed to the vulnerable code path.