SB20261110259 - Use of uninitialized resource in libde265

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110259

SB20261110259 - Use of uninitialized resource in libde265

Published: November 10, 2026

Security Bulletin ID SB20261110259
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose heap memory through decoded image pixels.

The vulnerability exists due to use of uninitialized heap memory in libde265's de265_image::fill_plane() when the 16-bit luma fill copies chroma_width instead of width pixels while generating unavailable reference pictures. A remote attacker can induce decoding of crafted HEVC or HEIC content with subsampled chroma, bit depth above eight, and missing reference pictures to expose heap contents in decoded output.


Remediation

Install update from vendor's website.

References