AIKIDO-2026-735473

TL;DR

libde265 shares per row CABAC context state (imgunit->ctx_models[row]) between worker threads during multi-threaded WPP (Wavefront Parallel Processing) decoding without proper synchronization. A crafted H.265 bitstream that repeats or rewinds slice_segment_address values inside a picture makes CTB rows already marked finished run again, so concurrent copy, release, assignment, and decouple of context_model_table state corrupts its ownership metadata and produces a heap use-after-free and double free. This can crash the decoder and, in principle, corrupt heap memory. The fix rejects out-of-order slice segments, resets WPP row progress per segment, and makes CTB progress counters and image integrity flags atomic.