CVE-2026-88373 Details
Description
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.
A NULL pointer dereference vulnerability has been identified in libde265, specifically in the NAL parsing functionality. This issue arises when the function 'de265_push_NAL()' is called with a NAL unit of zero length. The NAL unit created in this scenario may have a NULL backing buffer, which is then passed to 'memcpy()' as the destination argument. Although the length of the copy is zero, this situation violates the non-null requirement of 'memcpy()', leading to undefined behavior. In builds instrumented with Undefined Behavior Sanitizer (UBSan), this violation causes the process to terminate, creating a denial-of-service condition.
The vulnerability has been addressed in the latest commit by adding a validation step to reject NAL units shorter than the required two-byte header. This update ensures that zero-length units are not processed, preventing the NULL pointer dereference.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libde265/issues/534 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea | [email protected] | Source CodeVendor |
| https://github.com/strukturag/libde265/issues/534 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| libde265 | 4d45a6b |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |