CVE-2026-54241: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-54241 is a heap-based buffer overflow vulnerability in the libde265 HEVC decoder library, caused by a signed integer overflow in the SAO (Sample Adaptive Offset) sequential filter code path. It affects all versions of libde265 up to and including 1.0.18, as well as the master HEAD at the time of disclosure. The vulnerability was published on June 3, 2026 by researcher TristanInSec via a GitHub Security Advisory, with a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory).

The root cause is a signed 32-bit integer overflow (CWE-190) in apply_sample_adaptive_offset_sequential() within libde265/sao.cc (line 335), where the expression img->get_image_stride(0) * img->get_height(0) * img->get_bytes_per_pixel(0) is computed as a signed int. For large HEVC frame dimensions (e.g., 46341×46341 at 16-bit depth), this multiplication overflows INT32_MAX and wraps to a small positive value, causing new uint8_t[lumaImageSize] to allocate an undersized buffer (CWE-122). The SAO filter then reads from inputCopy using the full, non-overflowed stride, resulting in a heap out-of-bounds read of up to approximately 4.3 GB past a ~625 KB allocation. A crafted HEVC bitstream with pic_width = 46341, pic_height = 46341, bit_depth_luma_minus8 = 8, and sample_adaptive_offset_enabled_flag = 1 triggers the flaw — all values pass existing SPS validation. The fix is to widen the computation to size_t (GitHub Advisory).

Successful exploitation results in a heap out-of-bounds read of up to ~4.3 GB, with heap data read as pixel values and written to decoded output, leading to high confidentiality impact (sensitive heap memory disclosure) and high availability impact (potential crash or instability). Any application that uses libde265 for HEVC decoding is affected, including libheif (used by GNOME image viewers), VLC, and GStreamer. This vulnerability is independent of the previously fixed allocation overflow in GHSA-vv8h-932h-7r86, which widened a different code path to 64-bit (GitHub Advisory).

The vulnerability requires network delivery of a crafted HEVC bitstream and high attack complexity (e.g., the target must process the malicious file), but requires no privileges and no user interaction beyond normal media processing. No public exploit code or in-the-wild exploitation has been reported as of the time of this report. The CVE status remains "Reserved" in the NVD, and no CISA KEV listing has been identified. Community discussion has been detected (e.g., FreeBSD Ports and Debian OSV entries), but no threat actor attribution or weaponized exploit kits are known (GitHub Advisory, OSV Debian).

1. Craft malicious HEVC bitstream: Create a crafted HEVC file with SPS parameters pic_width = 46341, pic_height = 46341, bit_depth_luma_minus8 = 8 (16-bit depth), and sample_adaptive_offset_enabled_flag = 1. These values pass existing SPS validation in libde265.
2. Deliver the payload: Distribute the crafted HEVC file via a web page, email attachment, shared media file, or any channel that causes a vulnerable application (e.g., VLC, a GNOME image viewer using libheif, or a GStreamer pipeline) to decode the file.
3. Trigger integer overflow: When the target application decodes the file, apply_sample_adaptive_offset_sequential() computes the luma image size using signed 32-bit arithmetic, causing an integer overflow that wraps to a small positive value.
4. Undersized allocation: new uint8_t[lumaImageSize] allocates a buffer of only ~625 KB instead of the required size.
5. Heap OOB read: The SAO filter reads from inputCopy using the full (non-overflowed) stride, reading up to ~4.3 GB past the allocated buffer, exposing heap memory contents as decoded pixel output or causing a crash (GitHub Advisory).

• File System: Presence of HEVC/H.265 media files with unusually large declared frame dimensions (e.g., 46341×46341) in user download directories, temp folders, or media caches.
• Process: Crashes or abnormal termination of media-processing applications (VLC, GNOME image viewers, GStreamer pipelines) when opening specific HEVC files; core dump files generated by these processes.
• Logs: Application error logs showing memory allocation failures or segmentation faults in libde265 or libheif components; stack traces referencing apply_sample_adaptive_offset_sequential() in sao.cc.
• Network: Unexpected inbound delivery of .hevc, .h265, or container files (.mp4, .mkv, .heif) from untrusted sources to systems running vulnerable media software.

The vendor (strukturag) has released libde265 version 1.1.1 as the patched release, which widens the lumaImageSize computation from int to size_t in sao.cc. Users and Linux distribution maintainers should upgrade to version 1.1.1 or later immediately. As a workaround where patching is not immediately possible, restrict processing of untrusted HEVC media files and consider disabling SAO-enabled HEVC decoding in affected applications. Monitor downstream packages (libheif, VLC, GStreamer) for updated builds incorporating the fix (GitHub Advisory, OSV Debian).

The vulnerability was reported by researcher TristanInSec and published via the strukturag GitHub Security Advisory program. Community activity has been observed on FreeBSD Ports (freshports.org) and Debian's OSV tracker, indicating downstream Linux distributions are tracking the issue for package updates. No major vendor statements beyond the upstream advisory or significant media coverage have been identified at this time (GitHub Advisory, OSV Debian).