CVE-2026-45383 strukturag CVE debrief

Who should care

Users of libde265, particularly those who handle video decoding, should be aware of this vulnerability. If you're using libde265 in your applications, ensure you're running version 1.0.19 or later to mitigate this risk. This includes developers and operators working with video decoding processes, as well as security teams responsible for vulnerability management.

Technical summary

The vulnerability is a heap buffer overflow (out-of-bounds READ) in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. It occurs when decoding a WPP HEVC slice and `ctbAddrRS` exceeds `pps.CtbAddrRStoTS.size()`, causing an out-of-bounds read in `pps.CtbAddrRStoTS[ctbAddrRS]`. This was confirmed by AddressSanitizer and patched in version 1.0.19. The issue arises from the computation of `ctbAddrRS` as `ctbRow * ctbsWidth` within the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access reads past the end of the allocated vector.

Defensive priority

Medium

Recommended defensive actions

• Update libde265 to version 1.0.19 or later
• Review and monitor video decoding processes for potential exploitation
• Implement compensating controls such as input validation and bounds checking
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-21T21:16:50.000Z and was last modified on 2026-07-22T16:17:23.117Z. The NVD entry is currently MEDIUM. This information is based on the NVD entry and CVE record. The vulnerability affects libde265, an open-source implementation of the h.265 video codec. The issue arises in the `decoder_context::decode_slice_unit_WPP()` function in `libde265/decctx.cc` when decoding a WPP (Wavefront Parallel Processing) HEVC slice. No additional information is available on the vulnerability beyond what is provided in the CVE record and NVD entry.

Official resources