Vulnerability · Published Sep 11, 2026 · Assigned by GitHub_M

CVE-2026-54241libde265: SAO sequential filter heap buffer overflow via signed integer overflow

High 7.4

In plain English

A high-severity heap buffer overflow in libde265 from strukturag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	libde265	1.1.3-r0	ALPINE-CVE-2026-54241
Debian:12	libde265	1.0.11-1+deb12u3	DEBIAN-CVE-2026-54241
Debian:13	libde265	1.0.15-1+deb13u1	DEBIAN-CVE-2026-54241
Debian:14	libde265	1.1.1-1	DEBIAN-CVE-2026-54241
Ubuntu:24.04:LTS	libde265	1.0.15-1ubuntu0.1	USN-8573-1
Ubuntu:24.04:LTS	libde265	1.0.15-1ubuntu0.1	UBUNTU-CVE-2026-54241
Ubuntu:25.10	libde265	no fix listed	UBUNTU-CVE-2026-54241

Affected products (as reported)

Vendor	Product	Versions
strukturag	libde265	< 1.1.1

Weakness: CWE-122, CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

References

https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr x_refsource_CONFIRM