{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0420",
  "published": "2026-09-20T04:25:32Z",
  "modified": "2026-09-20T02:43:47Z",
  "summary": "Updated libde265 package fixes security vulnerabilities",
  "details": "Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers\nto crash the application via crafted payload to display444as420 function\nat sdl.cc. (CVE-2024-38949)\nHeap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers\nto crash the application via crafted payload to __interceptor_memcpy\nfunction. (CVE-2024-38950)\nstrukturag libde265 commit d9fea9d wa discovered to contain a\nsegmentation fault via the component\ndecoder_context::compute_framedrop_table(). (CVE-2025-61147)\nNULL Pointer Dereference in libde265. (CVE-2026-33164)\nHeap out-of-bounds write in libde265 1.0.16. (CVE-2026-33165)\nlibde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via\nunvalidated PPS tile geometry. (CVE-2026-45382)\nlibde265 has a heap buffer overflow (OOB read) in\ndecode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access —\nlibde265 <= v1.0.18. (CVE-2026-45383)\nlibde265 has an out-of-bounds write in process_reference_picture_set via\npredicted short-term RPS. (CVE-2026-49295)\nlibde265 has an unbounded memory leak via orphaned slice headers in\n`read_slice_NAL`. (CVE-2026-49337)\nlibde265 has a heap buffer overflow in de265_image_get_buffer via SPS\ndimension integer overflow. (CVE-2026-49346)\nPixel accessor signed integer overflow causes heap OOB read/write.\n(CVE-2026-54240)\nSAO sequential filter heap buffer overflow via signed integer overflow.\n(CVE-2026-54241)\n",
  "upstream": [
    "CVE-2024-38949",
    "CVE-2024-38950",
    "CVE-2025-61147",
    "CVE-2026-33164",
    "CVE-2026-33165",
    "CVE-2026-45382",
    "CVE-2026-45383",
    "CVE-2026-49295",
    "CVE-2026-49337",
    "CVE-2026-49346",
    "CVE-2026-54240",
    "CVE-2026-54241"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0420.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=35987"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8573-1"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/strukturag/libde265/issues/460"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/strukturag/libde265/issues/484"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-security-announce/2026/msg00324.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-security-announce/2026/msg00397.html"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "libde265",
        "purl": "pkg:rpm/mageia/libde265?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.16-4.1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    },
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "libde265",
        "purl": "pkg:rpm/mageia/libde265?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.16-4.1.mga10.tainted"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "tainted"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}