libde265 is an open‑source implementation of the H.265 video codec. In versions prior to 1.0.19, the decoder_context::decode_slice_unit_WPP() routine in libde265/decctx.cc contains a heap buffer overflow (an out‑of‑bounds read). When a WPP (Wavefront Parallel Processing) HEVC slice is decoded, the ctbAddrRS value is calculated as ctbRow multiplied by ctbsWidth in the entry‑point loop. If the PPS/SPS headers are crafted so that this value exceeds the size of the pps.CtbAddrRStoTS vector, the array access reads past the end of the vector, causing a heap‑buffer‑overflow. The flaw was confirmed by AddressSanitizer and can expose arbitrary data from the process memory. Version 1.0.19 patches the issue.

Affected product is the libde265 library released by strukturag. Versions 1.0.18 and earlier are vulnerable; the fix is available in version 1.0.19. The library is commonly embedded in media processing applications, including video players, broadcasters, and streaming services that support HEVC decoding.

The CVSS base score is 6.9, and the EPSS score is below 1 %, indicating a low likelihood of widespread exploitation at present. The vulnerability was not listed in CISA’s KEV catalog, suggesting no known large‑scale attacks. Exploitation requires an attacker to supply a specially crafted HEVC file containing malicious PPS/SPS values, which is practical for adversaries that can send media to a vulnerable decoder. Because the flaw is a read‑only error, it does not provide remote code execution, but it does expose memory contents that could compromise confidentiality of the host process.