CVE-2026-54241

libde265, an open-source H.265/HEVC video codec library, calculates the sample adaptive offset (SAO) input-buffer size using signed 32-bit arithmetic, which overflows when decoding a crafted HEVC stream with large frame dimensions and 16-bit luma samples. The overflow leads to an undersized heap allocation and an out-of-bounds heap read (CWE-190, CWE-122). An attacker who can supply such a stream can leak heap memory into decoded output (confidentiality impact) or crash the decoder (denial of service); the CVSS vector indicates no privilege or integrity impact. Any application, service, or distribution package embedding libde265 versions prior to 1.1.1 — including HEIF/HEVC image and video processing tools that use it as their HEVC decode backend — is affected. There is no known public proof-of-concept, no listing in CISA KEV, and no confirmed exploitation in the wild.

What to do: Upgrade libde265 to version 1.1.1 or install distribution updates containing the patched library, and rebuild or refresh any bundled/embedded copies (e.g., in libheif-based tools, media players, or transcoding services). Audit dependencies to find applications linking libde265, and until patched, avoid decoding untrusted HEVC/HEIF files with libde265-based tools — prioritize any internet-facing service that decodes user-supplied video.