https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T19:43:45.221439+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bdu:2026-14498 bdu:2026-14498 2026-09-29T19:43:45.225033+00:00 bdu:2026-14498 https://vulnerability.circl.lu/vuln/bell-cve-2026-45383 BELL-CVE-2026-45383 2026-09-29T19:43:45.225097+00:00

Affected: Alpaquita:stream: libde265

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-45383 fkie_cve-2026-45383 2026-09-29T19:43:45.225131+00:00

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-45383 UBUNTU-CVE-2026-45383 2026-09-29T19:43:45.225171+00:00

Affected: Ubuntu:Pro:16.04:LTS: libde265, Ubuntu:Pro:18.04:LTS: libde265, Ubuntu:Pro:20.04:LTS: libde265, Ubuntu:Pro:22.04:LTS: libde265, Ubuntu:24.04:LTS: libde265, Ubuntu:25.10: libde265, Ubuntu:Pro:26.04:LTS: libde265

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.