A heap out‑of‑bounds write in libde265 allows a crafted HEVC bitstream to overwrite two bytes beyond a heap allocation. The flaw occurs when the Log2CtbSizeY value changes after an SPS change while PicWidthInCtbsY and PicHeightInCtbsY remain constant, causing set_SliceHeaderIndex to index past the image‑metadata array. This memory corruption can lead to undefined behaviour; no evidence indicates it results in code execution. The CVSS score of 5.5 reflects moderate severity, signalling potential confidentiality, integrity, or availability impacts.

Any deployment of strukturag libde265 prior to version 1.0.17 is affected; the fix is available in 1.0.17 and newer.

The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require supplying a malicious HEVC stream to a vulnerable decoder—an attack vector inferred from the description. No confirmed privilege escalation or remote code execution has been reported. The moderate CVSS score and low exploitation probability suggest a low to moderate overall risk.