CVE-2026-33165 — Out-of-bounds Write in Libde265

CWE-787 — Out-of-bounds Write4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.0%
top 98.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Strukturag Libde265Struktur Libde265Debian Libde265
Timeline
PublishedMar 20

Description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in versio…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:HExploitability: 1.3 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/libde265< libde265 1.0.18-1 (forky)
▶NVDstruktur/libde265< 1.0.17
▶CVEListV5strukturag/libde265< 1.0.17
▶Debianstruktur/libde265< 1.0.18-1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
OSV
CVE-2026-33165: libde265 is an open source implementation of the h↗2026-03-20
▶

📋Vendor Advisories

1
Debian
CVE-2026-33165: libde265 - libde265 is an open source implementation of the h.265 video codec. Prior to ver...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33165 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶