libde265, an open-source H.265 decoder, contains a heap‑buffer‑overflow read in the function decoder_context::decode_slice_unit_tiles. Prior to version 1.0.19 it calculates a tile index from picture parameter set geometry without validating that the index is within the bounds of the CtbAddrRStoTS array. A malformed PPS that passes validation but describes geometry inconsistent with the sps can produce an out‑of‑bounds index, resulting in a four‑byte memory read beyond the allocated buffer. This flaw may expose arbitrary memory contents to a decoder that processes a crafted H.265 bitstream. The weakness is identified as CWE‑125.

Vendors affected are strukturag libde265 before version 1.0.19. Any installation using libde265 1.0.18 or older, and any application that links against that library, is potentially vulnerable.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack can be executed by delivering a specially crafted H.265 stream to any system that decodes video with the affected libde265. The exploit would read four bytes of memory, which could reveal confidential data or serve as a foothold for subsequent attacks if additional vulnerabilities are present. The risk remains moderate due to the modest CVSS score but low exploitation probability.