Dyingc

**Name of the Vulnerable Software and Affected Versions** libde265 versions prior to 1.0.20 **Description** An out-of-bounds array write exists in the h.265 video codec implementation. A crafted H.265 bitstream can trigger this issue within the `decoder context::process reference picture set()` function. The problem stems from a missing aggregate bound check on predicted short-term reference picture set entries; while individual list sizes are validated, the combined count after construction can exceed the 16-entry `PocStFoll` array, resulting in a write at index 16. This memory corruption could potentially allow an attacker to execute arbitrary code. **Recommendations** Update to version 1.0.20.

**Name of the Vulnerable Software and Affected Versions** libde265 versions prior to 1.0.20 **Description** An issue in the h.265 video codec implementation allows a crafted sequence of H.265 NAL units to cause the `decoder context::read slice NAL()` function to attach slice headers to a finished picture object that lacks an active image unit. This leads to attacker-controlled unbounded heap growth, as the retained headers are not freed until the picture is released, which may not occur during continuous streaming. **Recommendations** Update to version 1.0.20.

**Name of the Vulnerable Software and Affected Versions** libde265 versions prior to 1.1.0 **Description** An issue exists in the h.265 video codec implementation where a crafted H.265 bitstream containing large SPS dimensions and 16-bit bit depth triggers a signed integer overflow in the `de265 image get buffer()` function. This overflow results in the plane allocation size being wrapped to a small value of approximately 1 KB. Subsequently, the `fill image()` function calculates the actual size using `size t`, leading to approximately 4 GB of data being written into the undersized heap buffer, which can cause a denial of service. **Recommendations** Update to version 1.1.0.