What is the CVSS score of EUVD-2026-13810?

EUVD-2026-13810 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Libde265 are affected by EUVD-2026-13810?

libde265 versions prior to 1.0.17 contain a denial-of-service vulnerability triggered by malformed H.265 video streams that crash any application using the library to decode video content.. A patch is available.

How to fix or mitigate EUVD-2026-13810?

Within 24 hours: Identify all applications and systems running libde265 and document current versions. Within 7 days: Upgrade libde265 to version 1.0.17 or later across all affected applications; prioritize production video processing and streaming infrastructure. Within 30 days: Verify upgrades are deployed, test video decoding with internal test cases, and update inventory records.

Libde265 EUVD-2026-13810

| CVE-2026-33164 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-20 GitHub_M

Buffer Overflow Heap Overflow Libde265

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:19 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.0.17

EUVD ID Assigned

Mar 20, 2026 - 21:00 euvd

EUVD-2026-13810

Analysis Generated

Mar 20, 2026 - 21:00 vuln.today

CVE Published

Mar 20, 2026 - 20:33 nvd

HIGH 7.5

DescriptionGitHub Advisory

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.

AnalysisAI

A malformed H.265 PPS (Picture Parameter Set) NAL unit in libde265 prior to version 1.0.17 triggers a segmentation fault in the pic_parameter_set::set_derived_values() function, causing denial of service. Any application using affected versions of libde265 to decode H.265 video streams is vulnerable to crash via specially crafted video files or streams. The vulnerability has been patched in version 1.0.17, and a GitHub security advisory documents the issue.

Technical ContextAI

libde265 is an open-source H.265/HEVC video codec decoder library maintained by Struktur AG. The vulnerability exists in the picture parameter set (PPS) NAL unit parsing logic, where insufficient validation of malformed PPS data leads to a heap overflow condition classified under CWE-122 (Heap-based Buffer Overflow). The PPS is a critical H.265 syntax element that defines decoding parameters for entire pictures; malformed PPS data allows an attacker to bypass bounds checking in the derived values computation routine. The affected product is identified by CPE cpe:2.3:a:strukturag:libde265:*:*:*:*:*:*:*:* for all versions prior to 1.0.17. This library is commonly embedded in media players, transcoding services, and video streaming applications.

RemediationAI

Upgrade libde265 to version 1.0.17 or later immediately. For applications embedding libde265, update the library dependency to the patched version and rebuild. If direct upgrade is not immediately feasible, implement input validation at the application layer by rejecting or sandboxing untrusted H.265 video sources, and run video decoding processes with restricted privileges and memory isolation. Consider deploying decoded video processing in containerized environments with resource limits to mitigate denial-of-service impact. Refer to the GitHub release notes at https://github.com/strukturag/libde265/releases/tag/v1.0.17 for detailed upgrade instructions.