CVE-2026-33165: 
NixOS vulnerability analysis and mitigation

CVE-2026-33165 is a heap out-of-bounds write vulnerability in libde265, an open-source H.265/HEVC video codec implementation. It affects all versions prior to 1.0.17 and was discovered via libFuzzer with AddressSanitizer, disclosed on March 20, 2026. The flaw is triggered by a crafted HEVC bitstream that exploits a stale ctb_info.log2unitSize value after a Sequence Parameter Set (SPS) change, causing set_SliceHeaderIndex to write 2 bytes past the end of a heap-allocated image metadata array. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, libde265 v1.0.17).

The root cause (CWE-787: Out-of-bounds Write) lies in libde265/image.cc, where the reallocation condition for the ctb_info metadata array only checks PicWidthInCtbsY and PicHeightInCtbsY but not Log2CtbSizeY. When a crafted bitstream contains two SPS entries with identical CTB grid dimensions but different Log2CtbSizeY values (e.g., 5 then 6), the array is not reallocated for the second picture, leaving ctb_info.log2unitSize stale. During decoding of the second picture, read_coding_tree_unit computes pixel coordinates using the new Log2CtbSizeY (e.g., yCtbPixels = 4 << 6 = 256), but ctb_info.get(x, y) converts back to units using the stale value (256 >> 5 = 8), which equals height_in_units and is one row past the end of the 104-entry array, resulting in a 2-byte write beyond the heap allocation. The fix in commit c7891e4 adds Log2CtbSizeY to the reallocation condition (GitHub Advisory, Fix Commit).

Successful exploitation causes a heap buffer overflow that results in application crash (denial of service). In debug builds, the library's own bounds assertions abort execution; in release builds, the 2-byte write proceeds silently into adjacent heap memory, potentially corrupting a de265_progress_lock structure (containing a pthread_mutex_t and pthread_cond_t). There is no evidence of confidentiality or integrity impact beyond memory corruption; the primary consequence is availability loss for any application processing untrusted HEVC video files using the affected library (GitHub Advisory).

A public proof-of-concept is available in the GitHub Security Advisory, including a 254-byte minimized reproducer (reproducer.bin) and a standalone C program (poc.c) with full build instructions, confirmed by both AddressSanitizer and Valgrind (GitHub Advisory). Exploitation requires local access with low privileges and user interaction (i.e., a victim must open or process a crafted HEVC file). There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of active exploitation in the near term.

1. Craft a malicious HEVC bitstream: Construct a bitstream containing two SPS NAL units that share the same PicWidthInCtbsY and PicHeightInCtbsY values (e.g., both = 13×8) but differ in Log2CtbSizeY (e.g., SPS 0 uses value 5, SPS 1 uses value 6). The public 254-byte reproducer.bin from the advisory can be used directly.
2. Deliver the file to the target: Convince a local user with access to a libde265-based application (e.g., a media player or transcoder) to open the crafted .hevc or container file embedding the malicious bitstream.
3. Trigger decoding: The application passes the bitstream to the libde265 decoder. The decoder processes SPS 0, allocates ctb_info with log2unitSize=5, then processes SPS 1 without reallocating ctb_info (since grid dimensions are unchanged).
4. Trigger the OOB write: During decoding of the second picture, read_coding_tree_unit calls set_SliceHeaderIndex(0, 256, 0). Inside ctb_info.get(0, 256), the stale log2unitSize=5 computes unitY = 256 >> 5 = 8, which equals height_in_units=8, writing 2 bytes past the end of the heap allocation.
5. Achieve denial of service: In ASan/debug builds, the process aborts immediately. In release builds, the silent heap corruption may cause a crash during subsequent deblocking filter operations or destabilize the process (GitHub Advisory).

• Process: Application crash or unexpected termination of any process using libde265 when processing HEVC video files; AddressSanitizer output referencing de265_image::set_SliceHeaderIndex or read_coding_tree_unit in stack traces.
• Logs: Application error logs showing heap-buffer-overflow or Invalid write of size 2 at libde265/image.h:741; assertion failures at image.h:128–129 (unitX >= 0 && unitX < width_in_units or unitY >= 0 && unitY < height_in_units) in debug builds.
• File System: Presence of crafted .hevc files or media containers with unusual SPS parameter combinations (multiple SPS with identical CTB grid dimensions but differing Log2CtbSizeY); the specific 254-byte reproducer.bin file (SHA pattern identifiable via fuzzing corpus).
• Network: Unexpected delivery of small HEVC bitstream files (≈254 bytes) to media processing services or upload endpoints (GitHub Advisory).

Upgrade libde265 to version 1.0.17 or later, which includes the fix that adds Log2CtbSizeY to the ctb_info reallocation condition in image.cc (libde265 v1.0.17, Fix Commit). As a workaround where upgrading is not immediately possible, restrict access to HEVC video processing functionality to trusted users only, and implement input validation or sandboxing for HEVC bitstream processing. If HEVC decoding via libde265 is not required, consider disabling it entirely. Amazon Linux 2023 users can apply the update via ALAS2023-2026-1585.

The vulnerability was discovered by researcher "0xA13" using libFuzzer and AddressSanitizer and responsibly disclosed to the strukturag maintainers, who credited "Ana K." in the fix commit (Fix Commit). The advisory was published at a "Moderate" severity level by the maintainers, reflecting the local-only attack vector and DoS-only impact. Debian issued security advisory DLA-4550-1 for libde265, and Solus Linux included the fix in their Week 17 2026 update. No significant broader media coverage or threat actor commentary has been observed.