CVE-2026-54241: libde265: SAO sequential filter heap buffer overflow via signed integer overflow
Last updated 17 July 2026
Other sources
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libde265to a version that resolves this vulnerability.Fixed in 1.1.1-1 - Upgrade
Upgrade
libde265to a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
What inputs are required to trigger the flaw?
An attacker needs to supply a crafted HEVC stream with large dimensions and 16-bit luma samples. Exploitation does not require privileges or user interaction according to the provided vector, but the attack complexity is high.
Which deployments are exposed?
Deployments using libde265 versions earlier than 1.1.1 are affected when they decode attacker-controlled HEVC content. The provided data does not identify specific applications or Debian package versions.
What is the impact of successful exploitation?
The undersized allocation can lead to an out-of-bounds heap read. This may expose heap data in decoded output or cause the decoder to crash; the supplied severity vector indicates high confidentiality and availability impact, with no integrity impact.
What remediation is available?
Update libde265 to version 1.1.1, which contains the patch. No alternative mitigation is provided in the available data.