What is the CVSS score of CVE-2026-54241?

CVE-2026-54241 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of libde265 are affected by CVE-2026-54241?

libde265, a widely-used open-source H.265/HEVC video codec library, contains a heap buffer overflow that allows unauthenticated remote attackers to trigger denial-of-service and extract sensitive…. A patch is available.

How to fix or mitigate CVE-2026-54241?

Within 24 hours, inventory all systems using libde265 (media servers, video processing pipelines, encoding services, streaming platforms) and assess internet-facing exposure; verify which instances handle untrusted video input. Within 7 days, apply the vendor-released patch via strukturag GitHub advisory GHSA-j2qq-x2xq-g9wr and Ubuntu USN-8573-1 to all identified systems, prioritizing internet-accessible services. Within 30 days, complete patching across all libde265 installations, validate media processing functionality post-update, and review access logs for any exploitation attempts against systems patched after the initial vulnerability window.

libde265 CVE-2026-54241

EUVD-2026-76759 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-01 vendor:ubuntu

Buffer Overflow Heap Overflow

7.4

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.4 HIGH

Network vector reflects server-side media processing; AC:H for specific heap-layout precondition; I:N because no write control is established per available data.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Sep 11, 2026 - 22:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 11, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Sep 11, 2026 - 22:22 NVD

7.4 (HIGH)

Analysis Generated

Jul 03, 2026 - 23:34 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Heap-based buffer overflow in libde265, the open-source H.265/HEVC video codec library by strukturag, allows remote unauthenticated attackers to trigger memory disclosure and denial-of-service by supplying a specially crafted HEVC-encoded input. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) indicates network-reachable exploitation requiring high complexity but no authentication or user interaction, consistent with server-side media processing pipelines. No public exploit code and no CISA KEV listing are confirmed at time of analysis. Ubuntu has issued USN-8573-1 and a vendor patch is available via the strukturag GitHub advisory GHSA-j2qq-x2xq-g9wr.

Technical ContextAI

libde265 (strukturag/libde265) is a widely packaged, open-source C/C++ implementation of the H.265/HEVC video compression standard, used as a decoding backend by media frameworks including FFmpeg (via plugin), GStreamer, ImageMagick (for HEIF/AVIF), and numerous Linux distribution packages. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: during decoding of a crafted HEVC bitstream, a heap allocation is written beyond its allocated boundary. The CVSS metrics C:H/I:N/A:H (confidentiality high, integrity none, availability high) are characteristic of a heap overflow that exposes adjacent heap memory contents to the caller (information disclosure) and causes a crash (denial of service) but does not provide reliable arbitrary write control - meaning exploitation for code execution would be significantly harder than the raw overflow suggests. AC:H confirms that exploitation requires specific memory layout or codec-state preconditions beyond the attacker's direct control.

RemediationAI

Apply the vendor-released patch documented in GitHub Security Advisory GHSA-j2qq-x2xq-g9wr at https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr - the exact fixed version is not independently derivable from the provided input data and should be confirmed in the advisory. On Ubuntu, apply the updated libde265 package per USN-8573-1 (https://ubuntu.com/security/notices/USN-8573-1) using standard package manager updates. As a compensating control where patching is not immediately possible, restrict or disable acceptance of untrusted HEVC/H.265 video input at the application or API gateway layer - this is the primary exploitation path given UI:N/AV:N. Transcoding pipelines should validate and sandbox media processing jobs in isolated worker processes so that a crash or heap leak does not affect the primary application. Do not rely on format-level filtering alone, as HEVC is widely used and blocking it broadly may disrupt legitimate workflows.