CVE-2026-33165

Katalog CVE

CVSS 5.0 · Medium EPSS 0,19%

Kerentanan Out-of-bounds Write pada struktur libde265. Skor CVSS 3.1 5.0 (Medium) menurut NVD.

Deskripsi (NVD)

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg exploit · patch · advisory vendor
• https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658 patch
• https://github.com/strukturag/libde265/releases/tag/v1.0.17 release notes