A NULL pointer dereference occurs in libde265’s NAL parsing path when de265_push_NAL() is called with a zero‑length NAL unit. The resulting NAL_unit retains a NULL backing buffer that is later passed as the destination argument to memcpy() in NAL_unit::set_data(). Though the copy length is zero, memcpy requires a non‑NULL pointer, so the undefined behavior leads to process termination. The primary impact is a denial of service that terminates any application using the library.

The issue exists in libde265, any build incorporating commit 4d45a6b or earlier. Systems that embed this library to parse HEVC streams and may feed it zero‑length NAL units are at risk. Applications that rely on de265_push_NAL() without validating input length could be affected.

The CVSS score of 7.5 indicates a high‑severity vulnerability with a target assessment of potential exploitation. The EPSS score of <1% implies a very low probability of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is exploitable by supplying a crafted input containing a zero‑length NAL unit to de265_push_NAL(). The likely attack vector is through data supplied to the library from external sources, such as network‑received video streams or user‑provided files, which can be triggered remotely if the application processes externally supplied video data, or locally if the application accepts arbitrary input. The exploitation requires no privileged access beyond the ability to provide such input.