CVE-2026-54241

What it actually does

Signed 32-bit arithmetic in sample adaptive offset buffer size calculation permits integer overflow from a crafted HEVC stream containing large dimensions and 16-bit luma samples, resulting in an undersized heap allocation followed by an out-of-bounds read that may leak heap contents into decoded frames or trigger a crash.

Why it matters to the business

Applications that decode untrusted HEVC video streams may leak sensitive memory contents or experience denial of service, increasing risk for media-processing pipelines, video players, and any downstream systems that rely on libde265.

How an attack unfolds

An attacker crafts a malicious HEVC bitstream with oversized frame dimensions and 16-bit samples that triggers the signed 32-bit size calculation to underflow. The decoder allocates an undersized buffer and subsequently reads beyond its bounds while processing the stream, exposing heap data or crashing the process.

How to fix it

Upgrade libde265 to version 1.1.1 or later. Where immediate upgrade is not possible, avoid decoding untrusted HEVC streams or apply input validation that rejects streams with dimensions exceeding safe 32-bit signed limits.

How to confirm the fix worked

Confirm the installed libde265 version is 1.1.1 or newer; re-test decoding of the original proof-of-concept stream to verify absence of overflow or out-of-bounds access; review build logs or package manifests for the patched release.

Typical attack path

1. attacker generates a specially crafted HEVC file with large dimensions and 16-bit luma samples
2. victim application opens or processes the file using a vulnerable libde265 version
3. integer overflow occurs during sample adaptive offset buffer sizing
4. undersized allocation leads to out-of-bounds heap read during decoding
5. attacker observes leaked heap data in output frames or causes process crash

How to detect it

Search application and system logs for decoder crashes or abnormal memory access patterns when processing HEVC input; inspect decoded output frames for unexpected pixel data that may indicate heap leakage; review process crash dumps for signs of out-of-bounds reads in the sample adaptive offset routine.

What your security team should do

• Prioritize upgrade of libde265 to 1.1.1 across all media-processing and video-handling components within 30 days
• Inventory all direct and transitive dependencies that ship libde265 and schedule coordinated updates
• Implement content-type and dimension sanity checks before invoking the decoder on untrusted input
• Monitor EPSS and exploit maturity signals for any future increase in observed activity