CVE-2026-45382

What it actually does

CVE-2026-45382 is an out-of-bounds heap read in libde265 before version 1.0.19, an open-source H.265/HEVC video decoder. The vulnerable code path is in decoder_context::decode_slice_unit_tiles, where picture-parameter-set-controlled tile boundary data can cause ctbAddrRS to be calculated beyond the bounds of the CtbAddrRStoTS array. When a malformed H.265 stream contains PPS geometry that is inconsistent with the SPS but still passes earlier derived-value validation, libde265 may read 4 bytes past the allocated heap buffer. The most likely technical outcome is process crash or abnormal decoder termination, producing denial of service in applications or services that parse untrusted H.265 media. Based on the provided scoring and description, confidentiality and integrity impact are not expected, and no public exploit maturity is currently reported.

Why it matters to the business

Organizations using libde265 directly or through media-processing applications, thumbnailers, messaging platforms, browsers, content ingestion pipelines, transcoding services, or file-scanning workflows may be exposed to crashes when processing malicious H.265 content. The operational risk is primarily service disruption: failed video processing jobs, crashed worker processes, interrupted user workflows, or availability degradation in systems that automatically decode uploaded or remote media. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, so broad exploitation appears unlikely at this time; however, internet-facing or automated media parsers should still prioritize remediation because exploitation requires only delivery of a malformed media stream to a vulnerable parser.

How an attack unfolds

An attacker crafts an H.265/HEVC bitstream containing a malformed picture parameter set with tile column or row boundary values that are internally inconsistent with the sequence parameter set. The crafted PPS is designed to pass libde265's set_derived_values checks while causing decoder_context::decode_slice_unit_tiles to compute a coding tree block raster-scan address that exceeds the size of the CtbAddrRStoTS mapping array. The attacker then delivers the file or stream to software that uses a vulnerable libde265 version, such as by upload, message attachment, web content, media ingestion, preview generation, or automated transcoding. When the decoder processes the malformed slice/tile structure, it performs a 4-byte heap read beyond the allocated array. In typical builds this can cause a crash, decoder error, worker restart, or failed media-processing task. There is no current indication of active exploitation, named threat actor use, or reliable code execution from the provided information.

How to fix it

Upgrade libde265 to version 1.0.19 or later wherever it is directly installed, statically linked, bundled, or embedded in downstream software. Because libde265 is commonly included indirectly through media libraries and applications, inventory both operating-system packages and vendored copies in containers, appliances, desktop applications, server-side media pipelines, and build artifacts. Rebuild or redeploy applications that statically link libde265 so they actually consume the fixed code. If immediate upgrade is not possible, reduce exposure by disabling H.265/HEVC decoding for untrusted inputs, isolating media parsing in sandboxed worker processes, enforcing file size and processing time limits, limiting automatic preview/transcoding of untrusted uploads, and using crash-restarting process supervisors with rate limiting to reduce denial-of-service impact.

How to confirm the fix worked

Confirm that all runtime locations report libde265 version 1.0.19 or later, including package-manager installations, container images, statically linked binaries, and application-bundled shared libraries. Validate with software composition analysis, package queries, SBOM review, container image scans, and binary inspection where necessary. For source builds, verify that the fix for bounds-validating the ctbAddrRS-derived access in decoder_context::decode_slice_unit_tiles is present. In test environments, process known malformed HEVC regression samples for this issue or fuzz-generated tile-boundary cases and confirm the decoder rejects them cleanly without AddressSanitizer, heap-buffer-overflow, segmentation fault, or worker crash reports. For internet-facing media ingestion paths, confirm compensating controls such as sandboxing and content-type restrictions remain active after upgrade.

Typical attack path

1. Identify an application, service, or workflow that decodes untrusted H.265/HEVC media using libde265 before version 1.0.19.
2. Craft or obtain a malformed H.265 stream with PPS tile geometry inconsistent with the SPS while still passing initial validation.
3. Deliver the crafted media through an accepted input path such as upload, attachment, embedded remote content, stream ingestion, or batch-processing queue.
4. Trigger media parsing or preview/transcoding so the vulnerable libde265 decoder reaches decoder_context::decode_slice_unit_tiles.
5. Cause an out-of-bounds heap read that may crash the decoder process or disrupt the media-processing workflow.
6. Optionally repeat submissions to create sustained denial of service against exposed parsing services.

How to detect it

Look for evidence of prior exploitation in media-processing application logs, upload service logs, transcoder and thumbnailer worker logs, crash reporters, endpoint telemetry, container restart events, and system journals. Key signals include crashes or abnormal exits of processes that decode HEVC/H.265 content, repeated failures while processing the same media object, AddressSanitizer or allocator reports mentioning heap-buffer-overflow in libde265, and stack traces referencing decoder_context::decode_slice_unit_tiles or libde265 decctx.cc. Correlate crash timestamps with recently received or processed H.265/HEVC files, uploads, attachments, or streams. For services exposed to untrusted users, investigate repeated media submissions followed by worker crashes, spikes in failed transcoding jobs, segmentation faults, or container restarts. Preserve suspicious media samples and relevant logs for controlled offline analysis in a sandboxed environment. There are no known threat actors or KEV-driven exploitation reports from the provided information, so detection should focus on crash forensics and malformed media processing artifacts rather than known campaign infrastructure.

• decoder_context::decode_slice_unit_tiles
• libde265/decctx.cc:966
• libde265/decctx.cc:920
• heap-buffer-overflow
• AddressSanitizer: heap-buffer-overflow
• CtbAddrRStoTS
• ctbAddrRS
• pps.CtbAddrRStoTS[ctbAddrRS]
• set_derived_values
• Segmentation fault
• SIGSEGV
• libde265
• de265_decode
• de265_new_decoder

What your security team should do

• Prioritize upgrading libde265 to 1.0.19 or later in any service that automatically processes user-supplied, externally sourced, or internet-delivered H.265/HEVC media.
• Inventory transitive and bundled use of libde265 across media applications, containers, desktop software, CI processing jobs, thumbnailers, and transcoding pipelines.
• Treat exposed media ingestion services as higher priority than systems requiring a trusted local file because exploitation can be triggered by crafted content submitted for decoding.
• If patching is delayed, temporarily disable HEVC decoding for untrusted inputs or route decoding through sandboxed, least-privileged worker processes with resource limits.
• Monitor decoder crashes and media-processing failures for signs of malformed HEVC input, especially repeated failures from the same source or against the same upload/ingestion endpoint.
• Add regression tests or fuzzing coverage for malformed PPS/SPS tile geometry to prevent reintroduction in downstream forks or patched builds.
• Track vendor advisories for applications that bundle libde265, because updating the operating-system package alone may not remediate statically linked or vendored copies.