Register | Log in

libde265

Choose email to subscribe with

general

source: libde265 (main)
version: 1.1.2-1
maintainer: Debian Multimedia Maintainers (archive) (DMD)
uploaders: Joachim Bauch [DMD] – Alessio Treglia [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.11-0+deb11u3
o-o-sec: 1.0.11-0+deb11u4
oldstable: 1.0.11-1+deb12u2
stable: 1.0.15-1
stable-sec: 1.0.15-1+deb13u2
testing: 1.1.2-1
unstable: 1.1.2-1

versioned links

1.0.11-0+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.11-0+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.11-1+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.15-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.15-1+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.1.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libde265-0
libde265-dev (1 bugs: 0, 0, 1, 0)
libde265-examples

action needed

14 security issues in bookworm high

There are 14 open security issues in bookworm.

11 important issues:

CVE-2026-33164: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.
CVE-2026-33165: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.
CVE-2026-45382: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.
CVE-2026-45383: libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.
CVE-2026-49295: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue.
CVE-2026-49337: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.
CVE-2026-49346: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.
CVE-2026-54240: libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.
CVE-2026-54241: libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.
TEMP-0000000-BB5891:
TEMP-0000000-E66AA0:

3 issues postponed or untriaged:

CVE-2023-51792: (needs triaging) Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding the maximum supported size of 0x10000000000.
CVE-2024-38949: (postponed; to be fixed through a stable update) Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc
CVE-2024-38950: (postponed; to be fixed through a stable update) Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy function.

Created: 2024-04-23 Last update: 2026-09-12 10:02

lintian reports 2 errors and 3 warnings high

Lintian reports 2 errors and 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-03 Last update: 2026-09-04 12:01

9 security issues in bullseye high

There are 9 open security issues in bullseye.

7 important issues:

CVE-2026-45382: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.
CVE-2026-45383: libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.
CVE-2026-49295: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue.
CVE-2026-49337: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.
CVE-2026-49346: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.
CVE-2026-54240:
CVE-2026-54241:

2 issues postponed or untriaged:

CVE-2024-38949: (needs triaging) Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc
CVE-2024-38950: (needs triaging) Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy function.

Created: 2026-06-20 Last update: 2026-08-06 10:30

3 security issues in buster high

There are 3 open security issues in buster.

2 important issues:

CVE-2024-38949: Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc
CVE-2024-38950: Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy function.

1 issue postponed or untriaged:

CVE-2023-51792: (postponed; to be fixed through a stable update) Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding the maximum supported size of 0x10000000000.

Created: 2024-06-27 Last update: 2024-06-28 15:00

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

TEMP-0000000-BB5891: (needs triaging)
TEMP-0000000-E66AA0: (needs triaging)

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-08-09 Last update: 2026-09-12 10:02

debian/patches: 3 patches to forward upstream low

Among the 4 debian patches available in version 1.1.2-1 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-09-03 19:00

testing migrations

This package will soon be part of the auto-ffmpeg transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[2026-09-09] libde265 1.1.2-1 MIGRATED to testing (Debian testing watch)
[2026-09-06] Accepted libde265 1.0.15-1+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-09-06] Accepted libde265 1.0.15-1+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-09-03] Accepted libde265 1.1.2-1 (source) into unstable (Joachim Bauch)
[2026-08-09] Accepted libde265 1.0.15-1+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Aron Xu)
[2026-08-06] Accepted libde265 1.0.15-1+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Aron Xu)
[2026-07-03] libde265 1.1.1-1 MIGRATED to testing (Debian testing watch)
[2026-07-01] Accepted libde265 1.1.1-1 (source) into unstable (Joachim Bauch)
[2026-04-26] Accepted libde265 1.0.11-0+deb11u4 (source) into oldoldstable-security (Andreas Henriksson)
[2026-04-05] libde265 1.0.18-1 MIGRATED to testing (Debian testing watch)
[2026-04-02] Accepted libde265 1.0.18-1 (source) into unstable (Joachim Bauch)
[2025-08-17] libde265 1.0.16-1 MIGRATED to testing (Debian testing watch)
[2025-05-13] Accepted libde265 1.0.16-1 (source) into unstable (Joachim Bauch)
[2024-02-02] Accepted libde265 1.0.11-0+deb11u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Thorsten Alteholz)
[2024-02-02] Accepted libde265 1.0.11-1+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Thorsten Alteholz)
[2023-12-30] Accepted libde265 1.0.11-0+deb11u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Thorsten Alteholz)
[2023-12-30] Accepted libde265 1.0.11-0+deb10u6 (source) into oldoldstable (Thorsten Alteholz)
[2023-12-29] libde265 1.0.15-1 MIGRATED to testing (Debian testing watch)
[2023-12-27] Accepted libde265 1.0.15-1 (source) into unstable (Joachim Bauch) (signed by: Aron Xu)
[2023-12-03] Accepted libde265 1.0.11-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Thorsten Alteholz)
[2023-11-30] Accepted libde265 1.0.11-0+deb10u5 (source) into oldoldstable (Anton Gladky)
[2023-11-24] libde265 1.0.13-1 MIGRATED to testing (Debian testing watch)
[2023-11-21] Accepted libde265 1.0.13-1 (source) into unstable (Joachim Bauch) (signed by: Thorsten Alteholz)
[2023-09-21] libde265 1.0.12-2 MIGRATED to testing (Debian testing watch)
[2023-09-19] Accepted libde265 1.0.12-2 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2023-06-25] libde265 1.0.12-1 MIGRATED to testing (Debian testing watch)
[2023-06-25] libde265 1.0.12-1 MIGRATED to testing (Debian testing watch)
[2023-06-25] libde265 1.0.12-1 MIGRATED to testing (Debian testing watch)
[2023-06-20] Accepted libde265 1.0.12-1 (source) into unstable (Joachim Bauch) (signed by: Tobias Frost)
[2023-03-04] Accepted libde265 1.0.11-0+deb10u4 (source) into oldstable (Tobias Frost)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 0
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (2, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.1.1-1
1 bug

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing