CVE-2026-54241 Details
Description
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.
A heap buffer overflow vulnerability has been identified in libde265, an open-source implementation of the H.265 video codec, in versions through 1.0.18. The issue arises in the sample adaptive offset (SAO) processing, where signed 32-bit arithmetic is used to calculate the input buffer size. This can lead to an integer overflow when handling large HEVC dimensions with 16-bit luma samples, causing an undersized allocation. The SAO filter then reads beyond the allocated buffer, potentially exposing heap data in the decoded output or crashing the decoder.
Users can upgrade to libde265 version 1.1.1, which includes the necessary patch. Instructions for downloading this version are available on the libde265 GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libde265 | <= 1.0.18 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |