Use of uninitialized resource in libde265 - #VU164361
Published: November 10, 2026
Vulnerability identifier: #VU164361
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-908
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose heap memory through decoded image pixels.
The vulnerability exists due to use of uninitialized heap memory in libde265's de265_image::fill_plane() when the 16-bit luma fill copies chroma_width instead of width pixels while generating unavailable reference pictures. A remote attacker can induce decoding of crafted HEVC or HEIC content with subsampled chroma, bit depth above eight, and missing reference pictures to expose heap contents in decoded output.
Affected software
libde265
Remediation
Install security update from vendor's website.
libde265 - update to 1.1.3