CVE-2025-61147: 
NixOS vulnerability analysis and mitigation

CVE-2025-61147 is a segmentation fault vulnerability in strukturag libde265, a library for decoding H.265/HEVC video, triggered via the decoder_context::compute_framedrop_table() function. It affects libde265 versions up to and including commit d9fea9d (prior to version 1.0.17). The vulnerability was reported on September 4, 2025, and publicly disclosed in February 2026. It carries a CVSS v3.1 base score of 6.2 (Medium) (Feedly, GitHub Issue).

The root cause is improper validation of integer command-line parameters (classified as CWE-120, Buffer Copy without Checking Size of Input). Specifically, the dec265 tool used atoi() to parse the -T (highestTID), -t (nThreads), and -f (max_frames) arguments without bounds checking, allowing an attacker to supply an extremely large integer (e.g., -T 2147483648) that causes an out-of-bounds write in decoder_context::compute_framedrop_table() during slice segment header processing. The fix replaced atoi() calls with a new parse_param() function that validates input using std::stoi() with proper range and bounds checking (GitHub Commit, GitHub Issue). The vulnerability was discovered using CodeQL static analysis, and a proof-of-concept was generated using OptionFuzz (GitHub Issue).

Successful exploitation causes a segmentation fault (SIGSEGV) that crashes the application processing H.265/HEVC video content, resulting in a denial of service. There is no confidentiality or integrity impact — the vulnerability exclusively affects availability. Applications or services that invoke the dec265 command-line tool with user-controlled arguments are at risk of process termination (Feedly, GitHub Issue).

A proof-of-concept exploit is publicly available as a GitHub issue and an attached ZIP file (dec265-poc-1.zip), demonstrating the crash via AddressSanitizer with the command ./dec265/dec265 -T 2147483648 $POC (GitHub Issue). There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term (Feedly). Exploitation requires local access and the ability to supply crafted command-line arguments to the dec265 binary.

1. Obtain a vulnerable build: Compile libde265 at commit d9fea9d or earlier (e.g., CC=clang CXX=clang++ cmake ../ && make -j$(nproc)).
2. Prepare a valid H.265 input file: Obtain or craft a valid HEVC bitstream file to use as the decoder input ($POC).
3. Trigger the vulnerability: Execute the dec265 binary with an out-of-range integer for the -T parameter: ./dec265/dec265 -T 2147483648 $POC.
4. Observe crash: The oversized integer bypasses atoi() validation, propagates into decoder_context::compute_framedrop_table() via calc_tid_and_framerate_ratio(), and causes an out-of-bounds write (SIGSEGV) that crashes the process (GitHub Issue).

• Process: Unexpected crash or termination of dec265 or applications embedding libde265 when processing video files with unusual command-line parameters.
• Logs: AddressSanitizer output referencing decoder_context::compute_framedrop_table() in decctx.cc:2231; SIGSEGV signals from the dec265 process.
• File System: Presence of crash dump files or core dumps associated with the dec265 binary; presence of the PoC file dec265-poc-1.zip or its contents on the system (GitHub Issue).

Upgrade libde265 to version 1.0.17 or later, which includes the fix replacing unsafe atoi() calls with validated parse_param() input handling (GitHub Commit). As a workaround, restrict access to the dec265 command-line tool so that untrusted users cannot supply arbitrary arguments, particularly the -T, -t, and -f flags. Applications embedding libde265 as a library are not directly affected by the command-line parsing flaw but should still upgrade to the patched version as a precaution (Feedly).

The vulnerability was detected by Tenable's Nessus scanner (plugin ID 299833) and appeared in the SOS Intelligence CVE Chatter Weekly Top Ten for the week of March 23, 2026, indicating moderate community awareness (Tenable). No significant vendor statements or notable researcher commentary beyond the original GitHub issue report have been identified.