CVE-2026-54241: falha de alta gravidade em strukturag libde265
libde265: SAO sequential filter heap buffer overflow via signed integer overflow
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.4epss 0.4%
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Produtos afetados
strukturag · libde265CVEs relacionadas — strukturag libde265
No mesmo produto, das mais perigosas para as menos.
CVE-2026-45382MEDIUMlibde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometryEPSS 0.4%CVE-2026-45383MEDIUMlibde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 <= v1.0.18EPSS 0.4%CVE-2026-54240HIGHlibde265: Pixel accessor signed integer overflow causes heap OOB read/writeEPSS 0.4%CVE-2026-49346HIGHlibde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflowEPSS 0.4%CVE-2026-33164HIGHNULL Pointer Dereference in libde265EPSS 0.4%CVE-2026-49295HIGHlibde265 has an out-of-bounds write in process_reference_picture_set via predicted short-term RPSEPSS 0.3%