CVE-2026-88373 strukturag CVE debrief

Who should care

Defenders responsible for systems handling H.265 video decoding using libde265 should assess exposure and prioritize patching to prevent potential denial of service attacks. They should review the official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, they should review compensating

Why it matters

CVE-2026-88373 is a high-severity vulnerability in libde265 that can lead to denial of service. Defenders handling H.265 video decoding should verify and apply patches to prevent potential exposure.

• Denial of service due to process termination in UBSan-instrumented builds
• Potential for undefined behavior leading to system instability

Technical summary

The libde265 library has a NULL pointer dereference vulnerability in its NAL parsing path. This occurs when the de265_push_NAL() function is called with a zero-length NAL unit. As a result, the NAL_unit may retain a NULL backing buffer, which is then passed to memcpy(), violating its nonnull requirement and leading to undefined behavior. The vulnerability can be triggered by passing a zero-length NAL unit to de265_push_NAL(), causing the NAL_unit to retain a NULL backing buffer. This can result in process termination in UBSan-instrumented builds and denial of service.

Defensive priority

Defenders should prioritize verifying and applying patches for libde265, especially in systems handling H.265 video decoding.

Recommended defensive actions

• Verify and apply patches for libde265
• Review systems handling H.265 video decoding for potential exposure
• Monitor for and respond to potential denial of service attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a NULL pointer dereference in the NAL parsing path of libde265. This occurs when de265_push_NAL() is called with a zero-length NAL unit, leading to undefined behavior. The issue arises from the lack of proper handling of zero-length NAL units, which results in a NULL backing buffer being passed to memcpy(). To verify and apply patches, defenders should review the official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.