AIKIDO-2026-968823
libde265 is vulnerable to Use After Free
64
Medium Risk
This Affects:
libde265TL;DR
libde265's decoder_context::reset(), invoked during seeking, frees all slice-header structures while clearing the decoded picture buffer but leaves the previous_slice_header pointer dangling. When a dependent slice NAL unit is then decoded, the code copies from the freed slice header (*this = *ctx->previous_slice_header; in slice.cc), a heap use-after-free that can crash the decoder or disclose and corrupt freed memory. Triggering it needs a reset followed by a dependent slice from untrusted input. The fix nulls previous_slice_header in decoder_context::reset().
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you call de265_reset() (for example when seeking) and then decode dependent slices from untrusted input.
Background info
libde265 is vulnerable to Use After Free in versions 0.7.0 - 1.1.1.
How to fix this
Upgrade the libde265 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.