CVE-2022-1253 Heap-based Buffer Overflow in strukturag/libde265

High 7.4 Published 6 Apr 2022 Updated 2 Aug 2024

A heap-based buffer overflow in libde265 allows attackers to execute arbitrary code or cause denial of service via crafted video files.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-1253?

CVE-2022-1253 is a high-severity memory corruption vulnerability in Struktur Libde265, published on 6 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2022-1253?

It affects 1 product.

Products include Struktur Libde265.

How do I fix CVE-2022-1253?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-1253 being exploited?

There is no known exploitation of CVE-2022-1253 in the wild and no public exploit code.

All Struktur Libde265 vulnerabilities

Sources

Also known as ALPINE-CVE-2022-1253, DEBIAN-CVE-2022-1253, GHSA-232g-h7w4-2pxj, UBUNTU-CVE-2022-1253.