Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-54240

libde265: Pixel accessor signed integer overflow causes heap OOB read/write

CVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-54240

Published

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-54240

Published

libde265

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "strukturag",
                    "product": "libde265",
                    "versions": [
                        {
                            "version": "< 1.1.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON