PT-2021-7714 · Libde265+3 · Libde265+3
Dhbbb
·
Published
2021-06-24
·
Updated
2025-01-28
·
CVE-2021-36409
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libde265 version 1.0.8
Description
The issue is related to the insufficient use of the
assert() function in the sps.cc component of the libde265 h.265 video codec implementation. This can be exploited by a remote attacker using a specially crafted file, potentially allowing access to confidential data, disrupting data integrity, and causing a denial of service. The vulnerability is triggered when decoding a file fails the scaling list pred matrix id delta==1 assertion at sps.cc:925.Recommendations
For libde265 version 1.0.8, consider disabling the
assert() function in the sps.cc component or restricting the use of the vulnerable video codec implementation until a patch is available. As a temporary workaround, avoid using the libde265 library with untrusted input files to minimize the risk of exploitation.Exploit
Fix
DoS
Assertion Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Ubuntu
Libde265