CVE-2026-33164

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/strukturag/libde265/releases/tag/v1.0.17	Release Notes
https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:37

Type	Values Removed	Values Added
Summary		(es) libde265 es una implementación de código abierto del códec de vídeo h.265. Antes de la versión 1.0.17, una unidad NAL PPS H.265 malformada provoca un fallo de segmentación en pic_parameter_set::set_derived_values(). Este problema ha sido parcheado en la versión 1.0.17.

23 Mar 2026, 20:05

Type	Values Removed	Values Added
CWE		CWE-476
References	~~() https://github.com/strukturag/libde265/releases/tag/v1.0.17 -~~	() https://github.com/strukturag/libde265/releases/tag/v1.0.17 - Release Notes
References	~~() https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r -~~	() https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r - Exploit, Vendor Advisory
CPE		cpe:2.3:a:struktur:libde265::::::::
First Time		Struktur libde265 Struktur
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

20 Mar 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-20 21:17

Updated : 2026-06-17 10:37

NVD link : CVE-2026-33164

Mitre link : CVE-2026-33164

CVE.ORG link : CVE-2026-33164

JSON object : View

Products Affected

struktur

libde265

CWE

CWE-122

Heap-based Buffer Overflow

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-33164", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33164", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T16:50:40.237139Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "strukturag", "product": "libde265", "versions": [{"status": "affected", "version": "< 1.0.17"}]}]}], "published": "2026-03-20T21:17:16.233", "references": [{"url": "https://github.com/strukturag/libde265/releases/tag/v1.0.17", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17."}, {"lang": "es", "value": "libde265 es una implementaci\u00f3n de c\u00f3digo abierto del c\u00f3dec de v\u00eddeo h.265. Antes de la versi\u00f3n 1.0.17, una unidad NAL PPS H.265 malformada provoca un fallo de segmentaci\u00f3n en pic_parameter_set::set_derived_values(). Este problema ha sido parcheado en la versi\u00f3n 1.0.17."}], "lastModified": "2026-06-17T10:37:03.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40DB036E-3A5D-4245-B887-4123769ECB8D", "versionEndExcluding": "1.0.17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}