CVE-2026-33165

What it actually does

libde265 versions prior to 1.0.17 contain a heap out-of-bounds write in HEVC/H.265 bitstream parsing. A crafted stream can change sequence parameter set values so that PicWidthInCtbsY and PicHeightInCtbsY remain constant while Log2CtbSizeY changes, leaving stale ctb_info.log2unitSize state. Subsequent slice-header handling calls set_SliceHeaderIndex with metadata indexing based on inconsistent geometry and writes 2 bytes past the end of a heap allocation. The demonstrated impact is memory corruption leading to process crash and denial of service; reliable code execution has not been established from the provided data.

Why it matters to the business

Applications, desktop tools, media services, file previewers, transcoders, or security pipelines that decode untrusted HEVC/H.265 content through libde265 can be crashed by a malicious video file or stream. Operational impact is most relevant for systems that automatically process uploaded or received media, where repeated crafted inputs could disrupt media processing queues or dependent services. The vulnerability is not listed in CISA KEV, is not known to be used in ransomware campaigns, has low and stable EPSS, and has no reported public exploit maturity, so broad active exploitation urgency is currently lower than for internet-exploited flaws; however, media parsing bugs should still be patched because exploitation can be triggered through ordinary-looking content.

How an attack unfolds

An attacker prepares a malformed HEVC/H.265 bitstream that manipulates SPS changes to create inconsistent decoder state in libde265. The attacker then delivers the file or stream to a target workflow that uses a vulnerable libde265 version, such as a user opening a video, an application generating thumbnails, or a backend service transcoding or inspecting uploaded media. When the vulnerable decoder parses the crafted sequence and later processes the slice header, set_SliceHeaderIndex writes beyond the allocated heap metadata buffer. In observed conditions this corrupts heap memory and can terminate the decoding process, causing denial of service for the invoking application or service. There is no provided evidence of in-the-wild exploitation, named threat actor use, or reliable remote code execution.

How to fix it

Upgrade libde265 to version 1.0.17 or later wherever it is directly installed or bundled into applications, containers, appliances, media libraries, or desktop packages. If a vendor application statically links or embeds libde265, apply the vendor update that includes the libde265 1.0.17 fix rather than relying only on the system package. Rebuild dependent software after updating shared libraries where required. If immediate patching is not possible, reduce exposure by disabling HEVC/H.265 processing for untrusted content, blocking or quarantining HEVC uploads, processing media in a sandboxed worker with memory-safety mitigations, limiting worker privileges, and enforcing restart/rate limits for crash-prone media-processing jobs.

How to confirm the fix worked

Confirm that all runtime and build-time copies of libde265 report version 1.0.17 or later, including packaged libraries, statically linked binaries, containers, and third-party applications that bundle their own decoder. Use package manager inventory, software composition analysis, SBOM review, and binary inspection to identify vulnerable copies. Validate that media-processing services still function after upgrade and that crash telemetry no longer shows heap-buffer-overflow or segmentation faults in libde265 around slice-header or SPS processing. Where safe and authorized, run the upstream regression test or a known benign reproducer in a non-production environment and confirm that the patched decoder rejects or handles the file without AddressSanitizer findings or process termination.

Typical attack path

1. Identify an application or service that uses libde265 before version 1.0.17 to decode HEVC/H.265 media.
2. Create or obtain a crafted HEVC bitstream that changes SPS parameters in a way that leaves stale ctb_info.log2unitSize state.
3. Deliver the malicious media to the target through a file-open workflow, upload feature, message attachment, media library ingestion path, or transcoding pipeline.
4. Cause the vulnerable decoder to parse the crafted stream and call set_SliceHeaderIndex with inconsistent image metadata indexing.
5. Trigger a heap out-of-bounds write, typically resulting in decoder or application crash and denial of service.
6. Optionally repeat submissions to cause recurring failures in automated media-processing services.

How to detect it

Look for evidence that media files or streams caused libde265-based decoders to crash. Relevant sources include application error logs, media transcoding logs, upload or ingestion pipeline logs, system journals, endpoint crash reports, core dump metadata, container restart events, EDR process telemetry, and AddressSanitizer or fuzzing crash output. Search for crashes occurring while processing HEVC/H.265 content, especially repeated failures with the same input file, upload route, sender, or media job. On Linux, inspect syslog, journald, coredumpctl, container logs, and service supervisor logs for SIGSEGV, SIGABRT, heap corruption, or AddressSanitizer reports referencing libde265, set_SliceHeaderIndex, SPS, or slice-header processing. On Windows or macOS, review application crash reports for faulting modules or stack frames that include libde265. Since no public in-the-wild campaign or fixed network signature is provided, detection should focus on behavioral artifacts: decoder crashes, malformed HEVC inputs immediately preceding crashes, and repeated attempts to process suspicious H.265 files.

• libde265
• set_SliceHeaderIndex
• ctb_info.log2unitSize
• heap-buffer-overflow
• AddressSanitizer: heap-buffer-overflow
• ERROR: AddressSanitizer
• SIGSEGV
• SIGABRT
• Segmentation fault
• heap corruption
• H.265
• HEVC
• SPS
• SliceHeader

What your security team should do

• Inventory systems, applications, containers, and products that include libde265 or decode HEVC/H.265 content using libde265.
• Prioritize patching exposed media-processing workflows that automatically decode uploaded, emailed, downloaded, or externally supplied video content.
• Upgrade to libde265 1.0.17 or later, or apply vendor updates that explicitly include the libde265 fix.
• For systems that cannot be patched quickly, temporarily disable HEVC/H.265 processing of untrusted files or isolate decoding in sandboxed, low-privilege workers.
• Review crash logs and media-processing job failures since publication for signs of repeated libde265 crashes or heap-buffer-overflow reports.
• Add monitoring for decoder crashes tied to HEVC/H.265 inputs, especially repeated failures from the same source, queue, account, or upload channel.
• Because EPSS is low and stable and the issue is not in KEV, handle as a normal-priority patch for typical desktop exposure but elevate priority for high-volume automated media ingestion services.