EUVD-2026-76760Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Network delivery of crafted video justifies AV:N; AC:H for required memory/input conditions; C:H and A:H reflect heap over-read leak and crash; I:N as overflow enables reads not controlled writes.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
4DescriptionCVE.org
[Unknown description]
AnalysisAI
Integer overflow (CWE-190) in the libde265 open-source H.265/HEVC video decoding library enables unauthenticated remote attackers delivering crafted video content to cause high-confidence information disclosure and denial-of-service against the decoding process. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-reachable exploitation without credentials, though the AC:H modifier reflects a dependency on specific input structure or memory conditions. Ubuntu has issued USN-8573-1 and upstream advisory GHSA-ccfw-29x7-rrx3 confirms a vendor patch is available; no public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
libde265 (github.com/strukturag/libde265) is an open-source software implementation of the H.265/HEVC video codec standard, commonly embedded in media players, transcoding pipelines, and streaming servers. CWE-190 (Integer Overflow or Wraparound) describes arithmetic on bounded integer types producing an incorrect - typically truncated - result, usually occurring when parsing codec bitstream fields such as slice headers, picture parameter sets, or motion vector tables. In a video decoder context, an overflowed integer can produce an undersized buffer allocation or an incorrect loop bound, enabling reads beyond the allocated region. The CVSS impact profile (C:H/A:H/I:N) is architecturally consistent with an integer overflow that drives an out-of-bounds heap read: the over-read leaks process memory (confidentiality impact) and can corrupt decoder state sufficiently to crash the process (availability impact) without enabling a controlled write (ruling out integrity impact). The vulnerability is reachable through any code path that decodes attacker-influenced H.265 content.
RemediationAI
Apply the vendor-released patch as documented in GitHub Security Advisory GHSA-ccfw-29x7-rrx3 for libde265 (https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3). Ubuntu users should apply updates via USN-8573-1 (https://ubuntu.com/security/notices/USN-8573-1) using standard package management, typically by running apt-get update followed by apt-get upgrade on the libde265 package. Where patching cannot be applied immediately, restrict which sources are permitted to submit H.265 video content to services using libde265 - network-layer controls allowing only trusted, authenticated sources to deliver video significantly reduce the AC:H-constrained attack surface. Applications that support codec negotiation can disable H.265 decoding and fall back to H.264 or AV1, eliminating the attack surface entirely at the cost of H.265 playback capability. Note that exact fix versions are not independently confirmed beyond vendor advisory references.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today