CVE-2026-33165 heap out-of-bounds write in libde265 1.0.16

Medium 5.5 Published 20 Mar 2026 Updated 24 Mar 2026

A crafted HEVC bitstream triggers a heap out-of-bounds write in libde265, potentially allowing code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-33165?

CVE-2026-33165 is a medium-severity memory corruption vulnerability in Struktur Libde265, published on 20 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation. This issue has been patched in version 1.0.17.

Weakness: CWE-787

Which versions are affected by CVE-2026-33165?

It affects 1 product.

Products include Struktur Libde265.

How do I fix CVE-2026-33165?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-33165 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33165 exists.

All Struktur Libde265 vulnerabilities

Sources

Also known as ALPINE-CVE-2026-33165, DEBIAN-CVE-2026-33165, ECHO-fdba-52af-519e, GHSA-653q-9f73-8hvg, JLSEC-2026-159, UBUNTU-CVE-2026-33165.