CVE-2026-54240

libde265, an open-source implementation of the H.265 (HEVC) video codec, computes pixel offsets using signed 32-bit arithmetic, which overflows when an attacker supplies a crafted HEVC stream with very large image dimensions. The overflow leads to out-of-bounds heap reads and writes (CWE-190/CWE-787), potentially disclosing data, corrupting memory, or crashing the decoder; the CVSS vector reflects high confidentiality and availability impact with high attack complexity. Any application, media player, transcoding service, or embedded device that links or bundles libde265 and decodes untrusted HEVC streams is affected. Versions prior to 1.1.1 are vulnerable; version 1.1.1 contains the fix. No public proof-of-concept is known and the flaw is not in CISA's KEV, so exploitation is not currently observed.

What to do: Upgrade libde265 to version 1.1.1 or later and rebuild/redeploy any applications, plug-ins, or device firmware that link the library. Until patched, avoid decoding HEVC/H.265 files or streams from untrusted sources in applications that use libde265, and audit your software inventory (e.g., media players, transcoding services, embedded video pipelines) for bundled copies.