The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libde265-debugsourceUpgrade libde265-debuginfoUpgrade libde265Upgrade libde265-devel | Jul 8, 2026 | Jun 19, 2026 |
| Debian | — | Upgrade libde265 | Aug 9, 2026 | Aug 9, 2026 |
| Ubuntu | — | Upgrade libde265-0 (Ubuntu Pro)Upgrade libde265-dev (Ubuntu Pro)Upgrade libde265-0No solution existsUpgrade libde265-dev | Jul 21, 2026 | Jul 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub