CVE-2026-45382

Name of the Vulnerable Software and Affected Versions libde265 versions prior to 1.0.19

Description An issue exists in the decoder context::decode slice unit tiles() function where the software reads pps.CtbAddrRStoTS[ctbAddrRS] without validating the result against the size of the array. A malformed Picture Parameter Set (PPS) that encodes geometry inconsistent with the Sequence Parameter Set (SPS) can cause the ctbAddrRS variable to point outside the allocated memory, resulting in a 4-byte heap-buffer-overflow READ. A heap-buffer-overflow occurs when a program reads or writes data beyond the boundaries of a buffer allocated on the heap.

Recommendations Update to version 1.0.19.