libde265 Pixel Accessor Signed Integer Overflow (CWE-190) causing Heap OOB Read/Write

Summary of Signed Integer Overflow Vulnerability in libde265 Pixel Accessors Vulnerability Overview Vulnerability Name: Pixel accessor signed integer overflow causes heap OOB read/write CVE ID: CVE-2026-5420 Severity: High (CVSS 7.4/10) Vulnerability Type: Signed Integer Overflow (CWE-190) Description: All variants of in (lines 240–271) use signed 32-bit arithmetic to compute pixel offsets: When HEVC stream dimensions exceed (46341), overflows to a negative value, causing pointer arithmetic to yield an address below the buffer's starting address, triggering a heap out-of-bounds read/write. Scope of Impact Affected Versions: and master HEAD, all platforms Affected Functions: , , their const variants, and Trigger Conditions: Construct an HEVC stream with and (passing the existing validation). The decoder accesses row 46340 to trigger the out-of-bounds access. Example: With and , the product . This exceeds (2,147,483,647) and wraps around to . Impact: All pixel reads/writes in the decoder go through these accessors. Write operations may overwrite heap memory of approximately -2 GB (PCM output, transform coefficients, motion compensation, SAO filtering), and read operations may leak heap data. In the variant, left-shifting a negative value is undefined behavior in C++. Fix Cast or to or : Related References The allocation overflow was fixed in GHSA-vdh-9326-9786, which correctly adjusted the buffer size; this vulnerability is a separate accessor arithmetic issue. Reporter: TristanDec

Goal Reached Thanks to every supporter — we hit 100%!

libde265 Pixel Accessor Signed Integer Overflow (CWE-190) causing Heap OOB Read/Write

More from this source