CVE-2026-45382— libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry
Quick assessment
Affected
strukturag libde265
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
strukturag libde265是strukturag公司的一个处理HEVC视频编码的库。 libde265 1.0.19之前版本存在缓冲区错误漏洞，该漏洞源于在decoder_context::decode_slice_unit_tiles函数中，从PPS提供的colBd[]/rowBd[]数组计算ctbAddrRS时，未验证其结果是否在CtbAddrRStoTS.size()范围内，导致堆缓冲区越界读取。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| strukturag | libde265 | < 1.0.19 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45382
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry
Source: CVE Program / CVE List V5
Vulnerability Description
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
strukturag libde265 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
strukturag libde265是strukturag公司的一个处理HEVC视频编码的库。 libde265 1.0.19之前版本存在缓冲区错误漏洞，该漏洞源于在decoder_context::decode_slice_unit_tiles函数中，从PPS提供的colBd[]/rowBd[]数组计算ctbAddrRS时，未验证其结果是否在CtbAddrRStoTS.size()范围内，导致堆缓冲区越界读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| strukturag | libde265 | < 1.0.19 | - |
|
II. Public POCs for CVE-2026-45382
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45382
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45382 (1)
Same Patch Batch · strukturag · 2026-07-21 · 8 CVEs total
| CVE-2026-47247 | 7.5 HIGH | libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel |
| CVE-2026-47178 | 6.1 MEDIUM | libheif has Heap Out Of Bounds Write in unci subsystem |
| CVE-2026-47254 | 6.1 MEDIUM | libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vecto |
| CVE-2026-47714 | 6.1 MEDIUM | libheif has integer overflow in inline mask size calculation that causes undersized buffer |
| CVE-2026-45383 | libde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bound | |
| CVE-2026-47709 | libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed | |
| CVE-2026-47251 | libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_dat |
IV. Related Vulnerabilities
Same product: libde265
-
CVE-2026-54241
libde265: SAO sequential filter heap buffer overflow via sig -
CVE-2026-54240
libde265: Pixel accessor signed integer overflow causes heap -
CVE-2026-45383
libde265 has a heap buffer overflow (OOB read) in decode_sli -
CVE-2026-49346
libde265 has a heap buffer overflow in de265_image_get_buffe -
CVE-2026-49295
libde265 has an out-of-bounds write in process_reference_pic
Same vendor: strukturag
-
CVE-2026-120208
libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci M -
CVE-2026-84450
libheif: `clap` + oversized `ispe` aborts on an assert in `F -
CVE-2026-84449
libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV -
CVE-2026-84451
libheif: Incomplete fix for CVE-2026-62292 leaves libheif vu -
CVE-2026-84447
libheif: Derived-image indirect reference chains and tiled o
Same weakness: CWE-125
-
CVE-2026-120830
Libslirp: libslirp: out-of-bounds heap read in icmp_forward_ -
CVE-2026-120740
Hivex: hivex: denial of service via out-of-bounds read in bi -
CVE-2026-120060
psqlODBC does not validate server-supplied counts and length -
CVE-2026-120453
The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HF -
CVE-2026-120437
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds