CVE-2024-38950

What it actually does

Heap buffer overflow in Libde265 v1.0.15 triggered during memcpy operations on a crafted input, resulting in application crash (denial of service).

Why it matters to the business

Media processing or decoding services using the affected library can be forced offline, causing service disruption for any systems handling untrusted video or image content; the large number of downstream Ubuntu packages increases exposure across cloud and on-prem environments.

How an attack unfolds

An attacker crafts a malicious payload that, when processed by Libde265, causes an out-of-bounds write inside the __interceptor_memcpy function; the malformed input is supplied over the network or via a file, leading to an immediate crash without further code execution.

How to fix it

Upgrade affected packages to the listed fixed versions: linux-aws (Ubuntu 14.04 LTS) to 4.4.0-1002.2, linux-azure (14.04) to 4.15.0-1023.24~14.04.1, linux-lts-xenial (14.04) to 4.4.0-13.29~14.04.1, linux (16.04) to 4.2.0-16.19 and all other listed 16.04/18.04 variants to their respective fixed revisions; rebuild or redeploy any containers or images that embed the vulnerable Libde265 library.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed revisions for each Ubuntu release; run regression tests with known-malformed inputs to confirm the application no longer crashes; scan build artifacts for the vulnerable Libde265 version string.

Typical attack path

1. Identify a target application or service that links against Libde265 and accepts untrusted input.
2. Prepare a specially crafted payload designed to overflow the heap buffer during memcpy.
3. Deliver the payload via network request, file upload, or media stream.
4. Trigger processing of the input to invoke the vulnerable code path.
5. Observe application crash and resulting denial of service.

How to detect it

Review application and system logs for sudden crashes or segmentation faults in processes linked to Libde265; correlate with inbound media file uploads or streams immediately preceding the crash; examine core dumps or stack traces for memcpy-related faults.

What your security team should do

• Prioritize patching all listed Ubuntu packages within the next maintenance window given the public disclosure date.
• Add Libde265 version checks to software bill-of-materials and dependency scanners.
• Implement input sanitization or sandboxing for any media decoding pipelines until patches are applied.
• Monitor EPSS and exploit maturity indicators for any future increase in weaponization.