SB20261111135 - Gentoo update for libde265
Published: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2023-27102)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the decoder_context::process_slice_segment_header() function in decctx.cc. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
2) Heap-based buffer overflow (CVE-ID: CVE-2023-27103)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the derive_collocated_motion_vectors() function in motion.cc. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Buffer overflow (CVE-ID: CVE-2023-43887)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the pic_parameter_set::dump() function. A remote attacker can pass specially crafted data to the application, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) NULL pointer dereference (CVE-ID: CVE-2026-33164)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in pic_parameter_set::set_derived_values() function. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
5) Out-of-bounds write (CVE-ID: CVE-2026-33165)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can use a specially crafted HEVC bitstream, trigger an out-of-bounds write and perform a denial of service (DoS) attack.
6) Out-of-bounds read (CVE-ID: CVE-2026-45382)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in decoder_context::decode_slice_unit_tiles when processing malformed PPS tile geometry inconsistent with the SPS. A remote attacker can supply specially crafted slice and PPS NAL content to cause a denial of service.
Worker threads must be enabled, and the issue is triggered on the parallel multi-tile decode path with a slice header containing one or more entry point offsets.
7) Out-of-bounds read (CVE-ID: CVE-2026-45383)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in decoder_context::decode_slice_unit_WPP() when decoding a crafted WPP HEVC slice. A remote attacker can supply crafted PPS/SPS headers that cause out-of-bounds CtbAddrRStoTS access to cause a denial of service.
User interaction is required to open or process a crafted HEIF/HEVC file.
8) Out-of-bounds write (CVE-ID: CVE-2026-49295)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in process_reference_picture_set when processing a predicted short-term reference picture set. A remote attacker can provide a specially crafted predicted short-term reference picture set to cause a denial of service.
User interaction is required.
9) Memory leak (CVE-ID: CVE-2026-49337)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory for orphaned slice headers in read_slice_NAL when processing crafted NAL input. A remote attacker can cause a victim to process specially crafted NAL input to cause a denial of service.
10) Heap-based buffer overflow (CVE-ID: CVE-2026-49346)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or modify data.
The vulnerability exists due to a heap-based buffer overflow caused by an integer overflow in de265_image_get_buffer when processing SPS dimensions. A remote attacker can supply a crafted HEVC bitstream to cause a denial of service or modify data.
User interaction is required.
11) Integer overflow (CVE-ID: CVE-2026-54240)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose heap data and cause a denial of service.
The vulnerability exists due to signed integer overflow in the get_image_plane_at_pos pixel accessor variants when decoding a crafted HEVC bitstream. A remote attacker can supply a crafted HEVC bitstream to disclose heap data and cause a denial of service.
Exploitation requires HEVC picture dimensions exceeding the square root of INT32_MAX.
12) Out-of-bounds read (CVE-ID: CVE-2026-54241)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to a signed integer overflow in apply_sample_adaptive_offset_sequential() in libde265/sao.cc when processing a crafted HEVC bitstream. A remote attacker can provide a crafted HEVC bitstream with large image dimensions to disclose sensitive information and cause a denial of service.
Remediation
Install update from vendor's website.