CVE-2026-33165

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658	Patch
https://github.com/strukturag/libde265/releases/tag/v1.0.17	Release Notes
https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg	Exploit Vendor Advisory Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-20 21:17

Updated : 2026-03-23 20:09

NVD link : CVE-2026-33165

Mitre link : CVE-2026-33165

CVE.ORG link : CVE-2026-33165

JSON object : View

Products Affected

struktur

libde265

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-33165", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.3}]}, "published": "2026-03-20T21:17:16.453", "references": [{"url": "https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libde265/releases/tag/v1.0.17", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg", "tags": ["Exploit", "Vendor Advisory", "Patch"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17."}, {"lang": "es", "value": "libde265 es una implementaci\u00f3n de c\u00f3digo abierto del c\u00f3dec de video h.265. Antes de la versi\u00f3n 1.0.17, un flujo de bits HEVC manipulado causa una escritura fuera de l\u00edmites en el heap confirmada por AddressSanitizer. El desencadenante es un ctb_info.log2unitSize obsoleto despu\u00e9s de un cambio de SPS donde PicWidthInCtbsY y PicHeightInCtbsY permanecen constantes pero Log2CtbSizeY cambia, lo que hace que set_SliceHeaderIndex indexe m\u00e1s all\u00e1 del array de metadatos de imagen asignado y escriba 2 bytes m\u00e1s all\u00e1 del final de una asignaci\u00f3n de heap. Este problema ha sido parcheado en la versi\u00f3n 1.0.17."}], "lastModified": "2026-03-23T20:09:04.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40DB036E-3A5D-4245-B887-4123769ECB8D", "versionEndExcluding": "1.0.17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}