Listen to this Post
The vulnerability stems from improper state management during decoding of High Efficiency Video Coding (HEVC) streams. When processing a Sequence Parameter Set (SPS), libde265 maintains metadata arrays based on image dimensions. The flaw occurs when a new SPS is applied where the picture width in CTUs (PicWidthInCtbsY) and height in CTUs (PicHeightInCtbsY) remain numerically identical, but the log2 of the coding tree block size (Log2CtbSizeY) changes. This change alters the stride and count within the CTU grid. A stale value (ctb_info.log2unitSize) from the previous SPS is retained and used in the `set_SliceHeaderIndex` function to calculate an index for the image metadata array. Because the actual allocated array size is based on the new CTU dimensions (which may be smaller or structured differently), the stale calculation results in an index that exceeds the allocated bounds. The function subsequently writes two bytes past the end of the heap allocation, leading to a heap buffer overflow. This was confirmed with AddressSanitizer and fixed in version 1.0.17 by ensuring all CTU metadata is correctly re-initialized upon SPS changes.
Platform: libde265 library
Version: prior 1.0.17
Vulnerability: heap buffer overflow
Severity: critical
date: 03/20/2026
Prediction: already patched (1.0.17)
Analytics
What Undercode Say:
Check version pkg-config --modversion libde265 Reproduce with ASAN ./dec265 --asan crafted_hevcfuzzed.265 Patch diff focus git diff 1.0.16 1.0.17 -- libde265/ctu.cc
Exploit:
Crafted HEVC bitstream exploiting stale CTU index.
Protection:
Upgrade to v1.0.17, sanitize inputs, sandbox decoders.
Impact:
Remote code execution or application crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
