CVE-2026-33164 Details
Description
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.
A NULL pointer dereference vulnerability has been identified in libde265, an open-source implementation of the H.265 video codec, in versions through 1.0.16. This vulnerability arises when a malformed H.265 Picture Parameter Set (PPS) NAL unit is processed, leading to a segmentation fault in the 'pic_parameter_set::set_derived_values()' function. The issue was discovered through fuzz testing with AFL++ and can cause applications that use libde265, such as VLC, GStreamer, and Kodi, to crash when handling malformed H.265 input.
Users can upgrade to libde265 version 1.0.17 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libde265/releases/tag/v1.0.17 | [email protected] | Release Notes |
| https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| struktur libde265 | < 1.0.17 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |