Vulnerability · Published Sep 11, 2026 · Assigned by GitHub_M

CVE-2026-54240libde265: Pixel accessor signed integer overflow causes heap OOB read/write

High 7.4

In plain English

A high-severity integer overflow in libde265 from strukturag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	libde265	1.1.3-r0	ALPINE-CVE-2026-54240
Debian:12	libde265	1.0.11-1+deb12u3	DEBIAN-CVE-2026-54240
Debian:13	libde265	1.0.15-1+deb13u1	DEBIAN-CVE-2026-54240
Debian:14	libde265	1.1.1-1	DEBIAN-CVE-2026-54240
Ubuntu:24.04:LTS	libde265	1.0.15-1ubuntu0.1	USN-8573-1
Ubuntu:24.04:LTS	libde265	1.0.15-1ubuntu0.1	UBUNTU-CVE-2026-54240
Ubuntu:25.10	libde265	no fix listed	UBUNTU-CVE-2026-54240

Affected products (as reported)

Vendor	Product	Versions
strukturag	libde265	< 1.1.1

Weakness: CWE-190, CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

References

https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3 x_refsource_CONFIRM