CVE-2026-33165: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write…

PriorityP420medium5CVSS 3.1

AVLACLPRLUIRSUCNINAH

EPSS

0.23%

14.0th percentile

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	libde265	< libde265 1.0.18-1 (forky)	libde265 1.0.18-1 (forky)
struktur	libde265	< 1.0.17	1.0.17
struktur	libde265	>= 0 < 1.0.18-1	1.0.18-1
strukturag	libde265	< 1.0.17	1.0.17

CVSS provenance

nvdv3.15.0MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

osv5.0MEDIUM

vendor_debian5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.