CVE-2026-33165

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.

• CWE-787

• https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658Patch
• https://github.com/strukturag/libde265/releases/tag/v1.0.17Release Notes
• https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvgExploit, Patch, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33159Craft CMS is a content management system (CMS). From version…6.5
• CVE-2026-33160Craft CMS is a content management system (CMS). From version…5.3
• CVE-2026-33161Craft CMS is a content management system (CMS). From version…4.3
• CVE-2026-33162Craft CMS is a content management system (CMS). From version…6.5
• CVE-2026-33163Parse Server is an open source backend that can be deployed …6.5
• CVE-2026-33164libde265 is an open source implementation of the h.265 video…7.5
• CVE-2026-33166Allure 2 is the version 2.x branch of Allure Report, a multi…7.5
• CVE-2026-33167Action Pack is a Rubygem for building web applications on th…6.1
• CVE-2026-33168Action View provides conventions and helpers for building we…2.3
• CVE-2026-33169Active Support is a toolkit of support libraries and Ruby co…5.3
• CVE-2026-3317Reflected Cross-Site Scripting (XSS) vulnerability in Naviga…5.1
• CVE-2026-33170Active Support is a toolkit of support libraries and Ruby co…6.1