SB2026051962 - Multiple vulnerabilities in libde265

Description

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2026-45382)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decoder_context::decode_slice_unit_tiles when processing malformed PPS tile geometry inconsistent with the SPS. A remote attacker can supply specially crafted slice and PPS NAL content to cause a denial of service.

Worker threads must be enabled, and the issue is triggered on the parallel multi-tile decode path with a slice header containing one or more entry point offsets.

2) Out-of-bounds read (CVE-ID: CVE-2026-45383)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decoder_context::decode_slice_unit_WPP() when decoding a crafted WPP HEVC slice. A remote attacker can supply crafted PPS/SPS headers that cause out-of-bounds CtbAddrRStoTS access to cause a denial of service.

User interaction is required to open or process a crafted HEIF/HEVC file.

Remediation

Install update from vendor's website.

References

• https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9
• https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38