Libde265 EUVD-2026-13810

Remote unauthenticated attacker sends a malformed H.265 video file containing a crafted PPS NAL unit to an application using libde265 versions prior to 1.0.17. Victim must process the video file; no user interaction beyond normal file handling required.

While a specific CVSS score and vector are not provided, the vulnerability characteristics indicate moderate to high severity. The attack vector is network-based (malicious video file delivery), and complexity is low (crafted H.265 stream required but not requiring authentication or user interaction beyond initiating playback). The technical impact is denial of service via segmentation fault, which is reliable and automatable. The CWE-122 classification (heap overflow) suggests potential for memory corruption that could theoretically be escalated to code execution, though the current disclosure focuses on crash behavior. Patch availability is confirmed (v1.0.17 released), reducing real-world risk for proactive organizations. No EPSS score, KEV status, or public POC is documented in the provided intelligence, suggesting this may be a lower-profile vulnerability without widespread active exploitation. However, the attack surface is broad given libde265's integration into numerous multimedia applications, warranting prioritized patching.

An attacker crafts a malicious H.265 video file with a specially formed Picture Parameter Set NAL unit that violates expected structure but passes initial parsing checks. When a media application or streaming service using vulnerable libde265 attempts to decode this file, the malformed PPS triggers a heap buffer overflow during the set_derived_values() computation, causing immediate segmentation fault and service crash. This attack requires no authentication or special privileges; the attacker only needs to cause the victim to process the malicious video stream, making it suitable for denial-of-service attacks against video streaming platforms or peer-to-peer applications.