CVE-2026-88373: Null Pointer Dereference
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL() is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NALunit::setdata(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.
Affected Software
Event History
Frequently Asked Questions
What input is needed to trigger the issue?
An attacker needs to cause libde265 to process a zero-length NAL unit through de265_push_NAL(). This can leave the NAL unit without a backing buffer before NAL_unit::set_data() invokes memcpy().
What is the practical impact?
The undefined memcpy() call can terminate the process in UBSan-instrumented builds, resulting in denial of service. The provided information does not establish impacts beyond process termination.
How can I determine whether my code path is exposed?
Review whether your application passes externally supplied or otherwise attacker-controlled NAL units to de265_push_NAL(), and whether zero-length units can reach that call. Builds using UBSan are specifically described as terminating when the condition occurs.