The vulnerability is a NULL pointer dereference within libde265's handling of the Picture Parameter Set when processing an H.265 NAL unit. A malformed PPS NAL unit triggers a segmentation fault during the set_derived_values() call, causing the decoder process to terminate. The weakness is classified as an out‑of-bounds memory access and a null pointer dereference, consistent with the assigned CWEs. The resulting crash undermines availability of any software that relies on the library to decode video streams.

All installations of strukturag's libde265 released before version 1.0.17 are affected. The library is employed in many applications that decode H.265/HEVC content, so any component embedding the vulnerable library is at risk. The advisory confirms that the issue was fixed in version 1.0.17 and subsequent releases.

The CVSS score of 8.7 indicates high severity, while an EPSS score of less than 1% implies a relatively low likelihood of exploitation at present. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. If an application decodes untrusted H.265 data, an attacker could craft a malformed PPS NAL unit to trigger the crash and cause a denial of service. The likely attack vector is inferred to be remote via externally supplied media, but explicit details are not provided in the advisory.