libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8909-1 advisory.

    It was discovered that libde265 did not properly validate certain crafted H.265 bitstreams, leading to a     NULL pointer dereference. An attacker could possibly use this issue to cause libde265 to crash, resulting     in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When
    de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing
    buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data().
    Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in
    undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.
    (CVE-2026-88373)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When     de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing     buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data().
    Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in     undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.
    (CVE-2026-88373)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365378	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libde265 vulnerability (USN-8909-1)	Nessus	Ubuntu Local Security Checks	Local	high
473632	Echo: libde265: security update to 1.0.15-1+e13	Tenable Cloud Security	Echo Local Security Checks	Local	high
473632	Echo: libde265: security update to 1.0.15-1+e13	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
350201	Linux Distros Unpatched Vulnerability : CVE-2026-88373	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88373

high

Tenable Plugins

high

high

high

high