libde265 EUVD-2026-38079

Victim must open or render an attacker-supplied H.265 bitstream (raw stream, .heic, or HEVC-encoded video) using an application built against libde265 prior to 1.0.20; UI:R in the CVSS vector confirms user interaction is required. The malformed bitstream must contain a predicted short-term reference picture set whose aggregate NumDeltaPocs after appending the current-picture delta exceeds MAX_NUM_REF_PICS (16). Exploitation is limited by the need for the target host application to actually invoke libde265's HEVC parsing path on untrusted input, and by heap layout for any escalation beyond a crash; no authentication is required (PR:N) and no special server-side configuration is needed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) accurately reflects a client-side parsing bug: network-reachable via any application that decodes attacker-supplied HEVC content, but requires user interaction such as opening a file or visiting a page. Realistic risk is moderate-to-high because libde265 is embedded in libheif, GStreamer plugins, and various media tools, meaning a single crafted .heic or .h265 file could affect many downstream products. No EPSS, KEV, or POC signal is provided, so no public exploit identified at time of analysis; however, the published commit diff with explanatory comments makes the bug pattern trivially identifiable and increases the likelihood of weaponized fuzzer-derived POCs appearing soon. The C:N rating suggests memory disclosure is not the primary concern - exploitation is more likely to yield crashes (A:H) with a narrower path to RCE via heap corruption.

An attacker crafts a malicious H.265 bitstream (e.g., embedded in a .heic image or .mp4 video) where the predicted short-term reference picture set construction pushes NumDeltaPocs to 17, and delivers it via email attachment, web download, or messaging app. When the victim opens the file in a viewer that uses libde265 (directly or via libheif), the decoder writes past the 16-entry PocStFoll array, corrupting adjacent decoder state and crashing the process or potentially enabling code execution. No public POC has been identified, but the commit diff publicly documents the exact overflow condition.