CVE-2026-33164 NULL Pointer Dereference in libde265

High 8.7 Published 20 Mar 2026 Updated 23 Mar 2026

A malformed H.265 video file can cause a segmentation fault in libde265, leading to a denial of service for applications using the library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-33164?

CVE-2026-33164 is a high-severity vulnerability in Struktur Libde265, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit causes a segmentation fault in pic_parameter_set::set_derived_values(). This issue has been patched in version 1.0.17.

Weakness: CWE-476, CWE-122

Which versions are affected by CVE-2026-33164?

It affects 1 product.

Products include Struktur Libde265.

How do I fix CVE-2026-33164?

Upgrade to a fixed version.

Is CVE-2026-33164 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33164 exists.

All Struktur Libde265 vulnerabilities

Sources

Also known as ALPINE-CVE-2026-33164, DEBIAN-CVE-2026-33164, ECHO-3083-2a98-5f9b, GHSA-wqrf-6rf5-v78r, JLSEC-2026-158, UBUNTU-CVE-2026-33164.