CVE-2026-33164: 
NixOS vulnerability analysis and mitigation

CVE-2026-33164 is a NULL pointer dereference (and heap-based buffer overflow) vulnerability in libde265, an open-source H.265/HEVC video codec library. A malformed H.265 Picture Parameter Set (PPS) NAL unit triggers a segmentation fault in the pic_parameter_set::set_derived_values() function, causing a crash in any application using the library. All versions up to and including 1.0.16 are affected; the issue was discovered via AFL++ fuzzing and disclosed on March 17–20, 2026, with a fix released in version 1.0.17 (GitHub Advisory, libde265 Release). The CVSS v3.1 base score is 7.5 (High), and the CVSS v4.0 base score is 8.7 (High) (GitHub Advisory).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-122 (Heap-based Buffer Overflow), triggered when parsing a specially crafted H.265 PPS NAL unit. The vulnerable call stack begins at pic_parameter_set::read() → decoder_context::read_pps_NAL() → decoder_context::decode_NAL() → decoder_context::decode(), ultimately causing a SEGV READ in pic_parameter_set::set_derived_values() (GitHub Advisory). The vulnerability requires no authentication or user interaction and is exploitable over the network (AV:N/AC:L/PR:N/UI:N), meaning any service that accepts and decodes untrusted H.265 video streams is at risk. The bug was discovered through AFL++ fuzzing on Ubuntu 24.04 with Clang 18.1.3 against libde265 1.0.16.

Successful exploitation causes the libde265 decoder process to crash with a segmentation fault (SIGSEGV / Exit 139), resulting in a denial of service. Applications that embed libde265 — including VLC, GStreamer, libheif, GNOME Videos, and Kodi — would crash when processing a malformed H.265 file or stream, disrupting media playback and any dependent services (GitHub Advisory). There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability.

A proof-of-concept exploit (a malformed H.265 file poc_pps_segv.h265) is publicly available in the GitHub security advisory, with concrete reproduction steps confirmed by the reporter (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft or obtain the malformed H.265 file: Use the publicly disclosed PoC file poc_pps_segv.h265 from the GitHub advisory, or generate a similar file using a fuzzer (e.g., AFL++) targeting the H.265 PPS NAL unit parsing logic.
2. Identify a target: Locate a service or application that uses libde265 <= 1.0.16 to process H.265 video input — such as a media server running VLC, GStreamer, libheif, or Kodi, or a web service accepting video uploads.
3. Deliver the malformed file: Submit the crafted H.265 file to the target application via any supported input channel (e.g., file upload, RTSP/HTTP video stream, or local file path).
4. Trigger the crash: When the application attempts to decode the malformed PPS NAL unit, pic_parameter_set::set_derived_values() dereferences a null or invalid pointer, causing a segmentation fault (SIGSEGV) and crashing the decoder process.
5. Achieve denial of service: The target application terminates unexpectedly (Exit 139), disrupting media processing or service availability (GitHub Advisory).

• Logs: Application crash logs or core dumps referencing pic_parameter_set::set_derived_values(), pic_parameter_set::read(), or decoder_context::decode_NAL() in the stack trace; process exit with code 139 (SIGSEGV) in system or application logs.
• Process: Unexpected termination of media processing processes (e.g., vlc, gst-launch, dec265, kodi) with signal 11 (SIGSEGV).
• Network: Unusual or repeated delivery of small, malformed .h265/.hevc files to media ingestion endpoints; unexpected connection resets or service restarts following video stream processing.
• File System: Presence of unexpected .h265 or .hevc files in upload directories or temporary folders, particularly files that are unusually small or structurally malformed.

Upgrade libde265 to version 1.0.17 or later, which includes input validation fixes addressing CVE-2026-33164 and related issues (libde265 Release). If immediate patching is not possible, restrict network access to systems that process untrusted H.265 video streams and avoid exposing libde265-based services to untrusted input. Downstream distributions including Amazon Linux 2023 and Debian have issued updated packages (Amazon Linux Advisory, Debian Advisory).

The vulnerability was noted in Solus Linux's weekly update digest and covered by Linux security news outlets following the Debian and Amazon Linux advisories (Solus Forum, Linux Security). Detection plugins were published by Tenable Nessus (plugins 303275, 310419, 306214) and Qualys (6275344), indicating prompt uptake by vulnerability management vendors. No significant social media controversy or major media coverage has been observed beyond routine vulnerability tracking.