CVE-2026-54240: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-54240 is a signed integer overflow vulnerability in libde265 (an open-source HEVC/H.265 decoder library by strukturag) that causes heap out-of-bounds read and write via pixel accessor functions. All get_image_plane_at_pos variants in libde265/image.h compute pixel offsets using signed 32-bit arithmetic, which overflows for HEVC streams with large frame dimensions. It affects libde265 versions <= 1.0.18, with a fix available in version 1.1.1. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory).

The root cause is a signed 32-bit integer overflow (CWE-190) in four pixel accessor functions (get_image_plane_at_pos, get_image_plane_at_pos_NEW, their const variants, and get_image_plane_at_pos_any_depth) in libde265/image.h (lines 240–271). The expression ypos * stride is computed as a signed 32-bit multiplication; for HEVC streams with dimensions exceeding sqrt(INT32_MAX) (~46341 pixels), this overflows to a negative value, causing pointer arithmetic to reference memory approximately 2 GB before the image buffer — constituting an out-of-bounds write (CWE-787) and read. A crafted HEVC bitstream with pic_width = 46341 and pic_height = 46341 (both within the existing <= 65535 validation bounds) is sufficient to trigger the overflow on any decoder operation accessing pixels beyond row 46340. The any_depth variant additionally performs a left shift on a negative value, which is undefined behavior in C++. The fix is to widen the arithmetic to size_t or int64_t: return pixels[cIdx] + xpos + (size_t)ypos * stride; (GitHub Advisory).

Successful exploitation allows an attacker to corrupt heap memory approximately 2 GB before the image buffer through decoder operations including PCM output, transform coefficients, motion compensation, and SAO filtering, as well as read heap data from that region. This results in high confidentiality impact (heap data leakage) and high availability impact (heap corruption leading to crash or potential code execution), with no integrity impact per the CVSS assessment. The vulnerability is distinct from a previously fixed allocation overflow (GHSA-vv8h-932h-7r86); that fix correctly sized the buffer but did not address the accessor offset computation (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of this report. The CVE was reserved and details were published in June 2026, with the vulnerability requiring a crafted HEVC bitstream and an attack complexity rated High (network-accessible, no privileges or user interaction required beyond processing the malicious stream). The CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score is yet available given the recent reservation status (GitHub Advisory, OSV).

1. Craft malicious HEVC bitstream: Create a crafted HEVC bitstream with SPS parameters setting pic_width = 46341 and pic_height = 46341. Both values pass the existing <= 65535 validation in libde265 but are large enough to trigger the overflow.
2. Trigger decoder processing: Deliver the crafted bitstream to a target application using libde265 <= 1.0.18 for decoding (e.g., via a media file, streaming endpoint, or API call).
3. Trigger overflow: Any decoder operation that accesses pixels beyond row 46340 will compute ypos * stride (e.g., 46341 * 46352 = 2,148,044,832), which exceeds INT32_MAX and wraps to a large negative value (-2,146,922,464).
4. Achieve OOB access: The corrupted pointer arithmetic causes the decoder to read from or write to memory ~2 GB before the image buffer, leaking heap contents or corrupting heap metadata/data structures.
5. Leverage for further exploitation: Heap corruption may be leveraged for denial of service (crash) or, with additional exploitation primitives, potentially arbitrary code execution depending on the application's memory layout (GitHub Advisory).

• File System: Unexpected or malformed .hevc, .h265, or container files (.mp4, .mkv, .ts) with SPS dimensions of 46341×46341 submitted to media processing pipelines.
• Process: Crashes or abnormal termination of applications using libde265 when processing specific media files; core dumps from processes linked against libde265 <= 1.0.18.
• Logs: Application error logs showing segmentation faults, heap corruption errors, or address sanitizer (ASAN) reports referencing get_image_plane_at_pos in libde265/image.h.

Upgrade libde265 to version 1.1.1, which contains the fix widening the pixel offset arithmetic from signed 32-bit to size_t/int64_t. No configuration-based workaround is available since the overflow occurs in core decoder logic. Applications and distributions (including Debian) packaging libde265 should update to the patched version promptly. As an interim measure, operators can restrict processing of untrusted HEVC media files until the patch is applied (GitHub Advisory, FreshPorts).

The vulnerability was reported by security researcher TristanInSec and published as a GitHub Security Advisory by the strukturag maintainer (farindk) on June 3, 2026. Downstream distributions including Debian and FreeBSD (via FreshPorts) have begun tracking and packaging the fix. No significant broader media coverage or notable social media discussion has been identified beyond the advisory and package tracking (GitHub Advisory, FreshPorts).