EUVD-2026-86314
GHSA-24mr-r2pj-2fq7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HEVC stream with zero-length NAL
-
DeliveryDeliver malicious media to decoder app
-
Exploitde265_push_NAL retains NULL buffer
-
Executionmemcpy(NULL) triggers undefined behavior
-
ImpactProcess termination / decode abort (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application that feeds attacker-controlled data to libde265's NAL push API (de265_push_NAL) - i.e., any consumer decoding untrusted HEVC/H.265 input, including software using libheif for HEIF/HEIC. The specific trigger is a zero-length NAL unit reaching set_data() before the fix. Real-world impact is strongly gated by build configuration: full process termination occurs in UBSan-instrumented or hardened builds; standard production builds typically survive the zero-length memcpy but abort decoding of the affected stream. No authentication is required (PR:N) and the input can be remote, but a victim decode operation on the malicious media is necessary. |
| Impact | This is a genuine but low-priority denial-of-service issue whose CVSS score (7.5, driven by A:H) overstates real-world impact for typical deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) implies trivial remote unauthenticated crash, but the description is explicit that process termination occurs specifically 'in UBSan-instrumented builds' - memcpy(NULL, src, 0) with a zero-length copy is undefined behavior that most production (non-sanitized) libc/compiler builds treat as a benign no-op, so the A:H (full availability loss) is questionable outside hardened/debug builds. Even in production builds the fix comment indicates a zero-length NAL would fail header parsing in decode_NAL() and abort decoding of that stream, which is a lesser DoS. All secondary signals point to low urgency: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code is referenced (only the upstream issue and fix commit). Confidentiality and integrity impact are correctly N. Net: real bug, upstream-fixed, but not a patching emergency - prioritize behind higher-impact items. |
| Exploit ScenarioDerived | An attacker supplies a crafted HEVC/H.265 bitstream (e.g., a malicious file or media stream) containing a zero-length NAL unit to an application that decodes untrusted input via libde265. When de265_push_NAL() processes the empty unit, set_data() calls memcpy() with a NULL destination, triggering undefined behavior that aborts the process in UBSan/hardened builds or halts decoding of the stream otherwise. No public proof-of-concept is referenced; exploitation requires only that the victim application decode the attacker-supplied input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Pushing a zero-length NAL unit into libde265's de265_push_NAL() API leaves a NAL_unit with a NULL backing buffer that is then handed to memcpy() as the destination in NAL_unit::set_data(); although the copy length is zero, the call violates memcpy()'s nonnull contract and, in UBSan-instrumented or hardened builds, terminates the process, while standard production builds typically survive the call but abort decoding of the affected stream. The issue affects libde265 through the vulnerable snapshot 4d45a6b and any downstream consumer that decodes untrusted HEVC/H.265 data, including software using libheif for HEIF/HEIC handling; it is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), though a victim must actually decode the malicious media. Exploitation status is low-risk: there is no CISA KEV listing and no public exploit identified at time of analysis, EPSS is only 0.15% (4th percentile), and this analyst assessment rates the availability impact as Low rather than the High implied by the published 7.5 score, so the 7.5 overstates real-world impact for typical deployments.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply or backport commit f8d324914e43d92af23614f22959cf9eee7bf9ea, which returns DE265_ERROR_INVALID_ARGUMENT for any NAL shorter than two bytes in NAL_Parser::push_NAL() and adds n > 0 guards around the memcpy() calls in NAL_unit::append() and NAL_unit::set_data(); confirm the change is present in your vendored copy or distribution package before redeploying. Until that commit is adopted, the most effective compensating control is to enforce the same invariant in the consuming application: validate every buffer passed to de265_push_NAL() and reject any NAL whose length is less than 2 (including zero and negative values) at the container, demuxer, or API-wrapper layer, which defines the error cleanly instead of relying on undefined behavior, at the cost of requiring a code change in each consumer and providing no protection for third-party callers you do not control. For services that must handle untrusted media before patching, run the decoder in an isolated worker process or sandbox so an abort terminates only that child and can be restarted, trading throughput and added supervisory complexity for containment; UBSan-instrumented and hardened builds are the most affected, so avoid feeding them untrusted streams where possible, and note that the referenced issue (https://github.com/strukturag/libde265/issues/534) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-88373) should be monitored for vendor release guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libde265 is an open-source HEVC/H.265 video decoder library, and this flaw sits in its NAL (Network Abstraction Layer) parsing path. HEVC streams are delivered as NAL units preceded by a two-byte NAL unit header, and the library exposes de265_push_NAL() so applications can feed raw NAL data into the decoder. In the vulnerable code (snapshot 4d45a6b), NAL_Parser::push_NAL() did not enforce a minimum length, so a caller-supplied zero-length unit was accepted and the corresponding NAL_unit kept a NULL nal_data buffer; when that buffer was passed as the destination to memcpy() inside NAL_unit::set_data() (and similarly in NAL_unit::append()), the library relied on undefined behavior rather than a defined error path - memcpy() is declared with a nonnull parameter, so even a zero-length copy with a NULL destination is UB, which UBSan flags and aborts on, and which also caused header parsing in decode_NAL() to fail afterwards. This is a classic CWE-476 NULL pointer dereference class bug rooted in missing argument validation rather than memory corruption. The upstream fix (commit f8d324914e43d92af23614f22959cf9eee7bf9ea) addresses the root cause by returning a new DE265_ERROR_INVALID_ARGUMENT (enum value 21) whenever len < 2 in NAL_Parser::push_NAL(), documenting that a NAL unit must contain at least its two-byte header, and by guarding the memcpy() calls in append() and set_data() with n > 0 checks. CPE data for this CVE is uninformative (cpe:2.3:a:n/a:n/a), so the affected component must be identified by the libde265 source repository and its downstream consumers.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote untrusted input, no auth (AV:N/PR:N); full process crash only in UBSan/hardened builds while production builds merely abort the stream, so A:L not A:H; no C/I impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.
Executive ViewAI
A flaw in libde265, the HEVC/H.265 decoding library embedded in many media and imaging pipelines (including libheif-based HEIF/HEIC handling), allows a malformed media file to abruptly terminate or stall the decoding process on affected builds. The exposure is remotely reachable and unauthenticated, so anyone able to deliver a crafted video or image to a service or application that decodes untrusted media can degrade availability of that workload, though confidentiality and integrity are not affected. Leadership should care because affected decoding libraries are shared components: a single upstream gap can surface across product lines, ingestion services, and third-party software simultaneously, and no vendor fix is available yet, leaving mitigation dependent on operational controls.
No vendor-released patch identified at time of analysis; interim mitigations include sandboxing and low-privilege isolation of decoding workloads with automatic restart, memory and process limits, rate limiting and quarantine of untrusted HEVC/H.265 and HEIF/HEIC input at ingest, preferring non-hardened standard builds only where decode-abort is preferable to process termination, and continuous crash telemetry to detect malformed decoder input.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB