libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a crafted a file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libde265 | Mar 26, 2024 | Sep 16, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 16, 2021 |
| Debian | — | Upgrade libde265 | Jan 26, 2023 | Sep 16, 2021 |
| Freebsd | — | Upgrade libde265 | Feb 23, 2023 | Feb 21, 2023 |
| Gentoo Linux | — | Upgrade media-libs/libde265. | Aug 12, 2024 | Sep 16, 2021 |
| Ubuntu | — | Upgrade libde265-0 (Ubuntu Pro)Upgrade libde265-0 | Jan 31, 2024 | Sep 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub