VulertSecurity VulertSecurity

Vulnerability in libde265: Multiple Buffer Overflow Issues

libde265 Updated 02 Oct 2025

Summary

24/01/2023
N/A
Yes i
Unrated
Not published

DLA-3280-1: libde265 - security update. Affects libde265 versions < 1.0.3-1+deb10u3. Fixed in 1.0.3-1+deb10u3. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats
SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml
Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile
Javascript package-lock.json · yarn.lock · pnpm-lock.yaml
PHP composer.lock
Python poetry.lock · requirements.txt · Pipfile.lock
Go go.mod
Rust Cargo.lock
Ruby Gemfile.lock
Dart pubspec.lock
C/C++ conan.lock
Elixir mix.lock
Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

A free account is created for continuous monitoring. By scanning, you agree to our Terms & Conditions.

Sponsored Devnack Your last release was probably never penetration tested Manual testing by engineers who build software, not an auditor's checklist. Trusted by teams at Swift and Google Talk to Devnack

Background

libde265 is an open source implementation of the H.265 video codec. It is used for encoding and decoding H.265 video files. The library provides functions and algorithms to process video data efficiently. However, multiple buffer overflow vulnerabilities have been discovered in libde265, which could allow an attacker to execute arbitrary code or cause a denial of service (DoS) by exploiting these vulnerabilities.

Vulnerability Detail

The following buffer overflow vulnerabilities have been identified in libde265:

  1. CVE-2020-21596: A global buffer overflow in the decode_CABAC_bit function of libde265 v1.0.4 can be exploited via a crafted file.
  2. CVE-2020-21597: A heap buffer overflow in the mc_chroma function of libde265 v1.0.4 can be exploited via a crafted file.
  3. CVE-2020-21598: A heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function of libde265 v1.0.4 can be exploited via a crafted file.
  4. CVE-2022-43235: A heap buffer overflow in the ff_hevc_put_hevc_epel_pixels_8_sse function of libde265 v1.0.8 can be exploited via a crafted video file.
  5. CVE-2022-43236: A stack buffer overflow in the put_qpel_fallback function of libde265 v1.0.8 can be exploited via a crafted video file.
  6. CVE-2022-43237: A stack buffer overflow in the void put_epel_hv_fallback function of libde265 v1.0.8 can be exploited via a crafted video file.
  7. CVE-2022-43238: An unknown crash vulnerability in the ff_hevc_put_hevc_qpel_h_3_v_3_sse function of libde265 v1.0.8 can be triggered via a crafted video file.
  8. CVE-2022-43239: A heap buffer overflow in the mc_chroma function of libde265 v1.0.8 can be exploited via a crafted video file.
  9. CVE-2022-43240: A heap buffer overflow in the ff_hevc_put_hevc_qpel_h_2_v_1_sse function of libde265 v1.0.8 can be exploited via a crafted video file.
  10. CVE-2022-43241: An unknown crash vulnerability in the ff_hevc_put_hevc_qpel_v_3_8_sse function of libde265 v1.0.8 can be triggered via a crafted video file.
  11. CVE-2022-43242: A heap buffer overflow in the mc_luma function of libde265 v1.0.8 can be exploited via a crafted video file.
  12. CVE-2022-43243: A heap buffer overflow in the ff_hevc_put_weighted_pred_avg_8_sse function of libde265 v1.0.8 can be exploited via a crafted video file.
  13. CVE-2022-43244: A heap buffer overflow in the put_qpel_fallback function of libde265 v1.0.8 can be exploited via a crafted video file.
  14. CVE-2022-43245: A segmentation violation in the apply_sao_internal function of libde265 v1.0.8 can be triggered via a crafted video file.
  15. CVE-2022-43248: A heap buffer overflow in the put_weighted_pred_avg_16_fallback function of libde265 v1.0.8 can be exploited via a crafted video file.
  16. CVE-2022-43249: A heap buffer overflow in the put_epel_hv_fallback function of libde265 v1.0.8 can be exploited via a crafted video file.
  17. CVE-2022-43250: A heap buffer overflow in the put_qpel_0_0_fallback_16 function of libde265 v1.0.8 can be exploited via a crafted video file.
  18. CVE-2022-43252: A heap buffer overflow in the put_epel_16_fallback function of libde265 v1.0.8 can be exploited via a crafted video file.
  19. CVE-2022-43253: A heap buffer overflow in the put_unweighted_pred_16_fallback function of libde265 v1.0.8 can be exploited via a crafted video file.
  20. CVE-2022-47655: A buffer overflow in the put_qpel_fallback function of libde265 1.0.9 can be exploited.

These vulnerabilities can be triggered by processing specially crafted files or video streams, allowing an attacker to execute arbitrary code or cause a DoS condition.

How To Fix

Minimum fixed version

1.0.3-1+deb10u3

This is the first release that contains the fix.

sudo apt-get install --only-upgrade libde265

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There are no known workarounds for these vulnerabilities. It is recommended to apply the fix by upgrading to the latest version of libde265.

Conclusion

Multiple buffer overflow vulnerabilities have been discovered in libde265, an open source implementation of the H.265 video codec. These vulnerabilities can be exploited by processing specially crafted files or video streams, allowing an attacker to execute arbitrary code or cause a denial of service condition. To mitigate the risk, it is recommended to upgrade to the latest version of libde265. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for libde265 →

Share this vulnerability

FAQ

What is libde265?

libde265 is an open source implementation of the H.265 video codec, used for encoding and decoding H.265 video files.

A buffer overflow vulnerability occurs when a program writes data beyond the boundaries of a buffer, potentially overwriting adjacent memory and leading to arbitrary code execution or a denial of service.

These vulnerabilities can be exploited by processing specially crafted files or video streams that trigger the buffer overflow conditions in the affected functions of libde265.

These vulnerabilities can allow an attacker to execute arbitrary code or cause a denial of service condition by crashing the application or consuming excessive resources.

Yes, a fix is available for these vulnerabilities. It is recommended to upgrade to the latest version of libde265 to mitigate the risk.

Related vulnerabilities

Recent vulnerabilities recorded for libde265.

View all libde265 vulnerabilities →
Sponsored Devnack Your last release was probably never penetration tested Manual testing by engineers who build software, not an auditor's checklist. Trusted by teams at Swift and Google Talk to Devnack

How To Fix

Minimum fixed version

1.0.3-1+deb10u3

This is the first release that contains the fix.

sudo apt-get install --only-upgrade libde265

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →
Help improve this record
Report an issue or send feedback