EUVD-2026-38078Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Crafted H.265 stream delivered over network (AV:N, AC:L, PR:N) requires victim decode initiation (UI:R); impact is heap exhaustion only (A:L), no confidentiality or integrity consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes decoder_context::read_slice_NAL() (libde265/decctx.cc:481) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.
AnalysisAI
Unbounded heap growth in libde265 prior to version 1.0.20 allows remote attackers to exhaust process memory by delivering a crafted H.265 bitstream, resulting in denial of service. The flaw in decoder_context::read_slice_NAL() (decctx.cc:481) unconditionally attaches slice segment headers to finished picture objects regardless of whether an active image unit exists; in continuous streaming contexts these headers are never freed, enabling attacker-controlled memory accumulation without bound. No active exploitation is confirmed (not listed in CISA KEV) and no public POC has been identified at time of analysis, but the network-accessible, no-privileges-required vector makes any application consuming untrusted H.265 content an exposure surface.
Technical ContextAI
libde265 (CPE: cpe:2.3:a:strukturag:libde265:*:*:*:*:*:*:*:*) is an open-source software implementation of the H.265/HEVC video codec standard maintained by strukturag. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling): the function decoder_context::read_slice_NAL() parsed each incoming slice NAL unit and unconditionally called img->add_slice_segment_header(shdr), transferring ownership of the parsed slice header object to the current picture. When a crafted bitstream delivers non-first-slice NAL units while the picture is in a finished state (no active image unit), the headers are appended to img->slices but are never consumed by a decoding path, and are only freed when the picture object itself is released. In a continuous streaming scenario picture release may be indefinitely deferred, permitting the heap to grow without any upper bound. The fix in commit 683cb9fa (version 1.0.20) guards the add_slice_segment_header call inside a conditional that verifies an active image unit is present, and explicitly calls delete shdr in the else branch to immediately free headers that would otherwise be orphaned.
RemediationAI
Upgrade libde265 to version 1.0.20, which resolves the issue via commit 683cb9fa603e35840642f98765ab95cdb71cadf9; the advisory is available at https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm. Downstream packagers should rebuild dependent packages against 1.0.20 and distribute updated binaries through their release channels. For deployments unable to upgrade immediately, restrict ingestion of H.265 streams to trusted, internally-sourced content only, blocking untrusted or user-supplied HEVC input at the application layer - this eliminates the attack surface at the cost of reduced functionality for external media. As a containment control, enforce per-process virtual memory limits via cgroups (e.g., memory.max) or OS-level ulimits on processes that decode H.265 content; this bounds heap exhaustion to a process restart rather than host-level resource starvation, though it may cause service interruption under a sustained attack. Time-bounded decode sessions (enforce a maximum stream duration or periodic process recycling) also limit cumulative header accumulation, with the trade-off of added operational complexity.
Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. Rated critical severit
Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at sl
Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merg
Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_predic
Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at m
Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameter
Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_predic
Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to
Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segm
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mc_chroma function at motion.cc. Rated medi
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fa
Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-moti
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today