Alpine: multiple libde265 packages: security update to 1.1.3-r0

medium Tenable Cloud Security Plugin ID 477154

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted
H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in
`de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a
small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing
~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue. (CVE-2026-49346)

- libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19,
`decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]`
at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]`
arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed
PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS`
past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.
(CVE-2026-45382)

- libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap
buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in
`libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is
computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that
this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]`
reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by
AddressSanitizer. Version 1.0.19 patches the issue. (CVE-2026-45383)

- libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted
H.265 bitstream can cause an out-of-bounds array write in
`decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a
missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes
are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll`
array, writing at index 16. Version 1.0.20 patches the issue. (CVE-2026-49295)

- libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted
sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to
attach slice headers to a finished picture object that has no active image unit, resulting in attacker-
controlled unbounded heap growth. The retained headers are never freed until the picture is released,
which may not happen during continuous streaming. Version 1.0.20 patches the issue. (CVE-2026-49337)

Solution

Update the libde265 library and its related packages to version 1.1.3-r0 or later.

Plugin Details

Severity: Medium

ID: 477154

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/23/2026

Updated: 10/23/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.12

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C

CVSS Score Source: CVE-2026-49346

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2026-54241

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 5.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-45383

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 6/19/2026

Reference Information

CVE: CVE-2026-45382, CVE-2026-45383, CVE-2026-49295, CVE-2026-49337, CVE-2026-49346, CVE-2026-54240, CVE-2026-54241

Detections

Analytics