libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a crafted a file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-libde265 | Mar 26, 2024 | Sep 16, 2021 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Sep 16, 2021 | |
| Debian | debian-upgrade-libde265 | Feb 13, 2023 | Sep 16, 2021 | |
| Freebsd | freebsd-upgrade-package-libde265 | Feb 23, 2023 | Feb 21, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-media-libs-libde265 | Aug 12, 2024 | Sep 16, 2021 | |
| Ubuntu | ubuntu-pro-upgrade-libde265-0ubuntu-upgrade-libde265-0 | Jan 31, 2024 | Sep 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub