libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles (libde265/decctx.cc:920) reads pps.CtbAddrRStoTS[ctbAddrRS] at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd[]/rowBd[] arrays without validating the result against CtbAddrRStoTS.size() == sps->PicSizeInCtbsY. A malformed PPS that passes setderivedvalues but encodes geometry inconsistent with the SPS produces a ctbAddrRS past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in de265imagegetbuffer() (libde265/image.cc:128). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent fillimage() call computes the real size using sizet, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

Last updated 17 July 2026

Last updated 10 July 2026

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctbinfo.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing setSliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.

Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc