CVE-2026-33164

What it actually does

CVE-2026-33164 is a denial-of-service flaw in struktur libde265 before version 1.0.17. A malformed H.265/HEVC Picture Parameter Set (PPS) NAL unit can cause a segmentation fault in pic_parameter_set::set_derived_values() during video parsing. The practical technical impact is process crash and loss of availability in software that uses libde265 to decode untrusted H.265 content. The provided CVSS vector rates availability impact as high, with no confidentiality or integrity impact indicated.

Why it matters to the business

Applications, media pipelines, file processing services, content moderation systems, messaging platforms, browsers, viewers, or backend services that automatically parse H.265 video using vulnerable libde265 versions may be crashed by a specially crafted video stream or file. This can interrupt media ingestion, transcoding, preview generation, video playback, or any service path that decodes HEVC content. The EPSS score is low and there is no known CISA KEV listing or reported ransomware use, so broad active exploitation is not currently indicated; however, exposure is still important where untrusted media is processed at scale or where crashes can disrupt critical workflows.

How an attack unfolds

An attacker creates or obtains an H.265/HEVC video bitstream containing a malformed PPS NAL unit that triggers a segmentation fault in libde265's pic_parameter_set::set_derived_values() logic. The attacker then delivers that media to a vulnerable consumer of libde265, such as a media decoder, upload service, thumbnail generator, transcoding worker, content scanning pipeline, or application that automatically opens or processes H.265 input. When the vulnerable component parses the crafted NAL unit, the decoder dereferences invalid memory or otherwise enters an unsafe state and the hosting process crashes. If the process is part of a repeatedly invoked service, the attacker may be able to cause repeated crashes by submitting the same crafted media multiple times, resulting in denial of service.

How to fix it

Upgrade struktur libde265 to version 1.0.17 or later wherever it is used directly or bundled transitively by applications, media frameworks, container images, appliances, or desktop software. Rebuild statically linked applications that include vulnerable libde265 code, because updating the system package alone may not replace embedded copies. If immediate upgrade is not possible, reduce exposure by disabling H.265/HEVC decoding for untrusted inputs, blocking or quarantining HEVC uploads, processing untrusted media in isolated sandboxes, enforcing worker process restart limits and resource controls, and placing media conversion tasks in low-privilege containers or separate crash-tolerant queues.

How to confirm the fix worked

Confirm that all runtime and build-time copies of libde265 report version 1.0.17 or later. Check operating system packages, application dependency manifests, container images, statically linked binaries, and third-party media components for embedded libde265. Validate that services which process H.265 content have been restarted after patching. Where safe and authorized, test with a known non-malicious regression sample or vendor-provided test case that previously triggered the crash and confirm the decoder no longer segfaults. Also verify that untrusted HEVC content is either processed by patched components or isolated behind sandboxing and restart controls.

Typical attack path

1. Identify an application, service, or media pipeline that accepts or retrieves H.265/HEVC video content and uses libde265 prior to 1.0.17.
2. Craft a malformed H.265 bitstream containing a malicious PPS NAL unit designed to reach pic_parameter_set::set_derived_values().
3. Deliver the crafted file or stream through an exposed upload, message, feed, media-processing API, shared file, or network media path.
4. Wait for the vulnerable component to parse the H.265 content automatically or as part of normal user/service workflow.
5. Trigger a segmentation fault in the libde265 decoder, crashing the consuming process.
6. Repeat delivery if necessary to sustain service disruption or interfere with media processing availability.

How to detect it

Look for evidence of crashes in applications or services that decode H.265/HEVC content using libde265. Relevant sources include application logs, media processing job logs, crash dumps, systemd journal entries, syslog, container logs, Kubernetes pod restart events, core dump directories, EDR crash telemetry, and file upload or media ingestion logs. Focus on segmentation faults, SIGSEGV events, abnormal worker exits, repeated restarts, or failed transcoding/thumbnail/preview jobs that occurred immediately after processing HEVC/H.265 files. Correlate crash timestamps with recently uploaded or fetched media objects, especially files labeled .hevc, .h265, .265, .mkv, .mp4, or content identified as HEVC. For forensic triage, preserve the triggering media file if available and analyze it in an isolated environment only. There are no public threat actors, KEV exploitation, or ransomware campaigns currently associated with this vulnerability, so detection should emphasize crash patterns and malicious media delivery rather than known attacker infrastructure.

• pic_parameter_set::set_derived_values
• libde265
• SIGSEGV
• segmentation fault
• Segmentation fault
• core dumped
• NAL unit
• PPS NAL
• Picture Parameter Set
• HEVC
• H.265
• .hevc
• .h265
• .265
• de265_decode
• de265_decode_data
• de265_image

What your security team should do

• Inventory systems, applications, containers, and media-processing pipelines that use struktur libde265 or accept H.265/HEVC input.
• Prioritize patching internet-facing, unauthenticated, automated, or high-volume media processing services before end-user-only applications.
• Upgrade libde265 to version 1.0.17 or later and rebuild applications with statically bundled copies.
• Temporarily disable or restrict HEVC/H.265 processing for untrusted content if patching cannot be completed quickly.
• Add monitoring for repeated crashes, segmentation faults, worker restarts, and failed media-processing jobs involving H.265/HEVC content.
• Run dependency and container scans to identify transitive or embedded vulnerable libde265 copies.
• Ensure media decoders run with least privilege, sandboxing, memory safety controls, and automatic recovery limits to reduce denial-of-service blast radius.