PT-2022-7255 · Libde265+4 · Libde265+4

Peng Deng · Published 2022-10-10 · Updated 2025-06-25 · CVE-2022-43242

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Libde265 versions 1.0.8

Description The issue is related to a heap-buffer-overflow vulnerability via the mc luma function in motion.cc, which allows attackers to cause a Denial of Service (DoS) via a crafted video file. This vulnerability is associated with the processing of unsigned char data type and can be exploited by a remote attacker.

Recommendations For Libde265 version 1.0.8, update to version 1.0.11 to fix the security issue. As a temporary workaround, consider restricting the use of the mc luma function in motion.cc to minimize the risk of exploitation. Avoid using the mc luma function with crafted video files until the issue is resolved.

Exploit

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-01149

CVE-2022-43242

DLA-3280-1

DSA-5346-1

MGASA-2023-0093

ROSA-SA-2025-2630

ROSA-SA-2025-2631

USN-6627-1

Affected Products

Astra Linux

Libde265

Linuxmint

Red Os

Ubuntu

References · 46

• 🔥 https://github.com/strukturag/libde265/issues/340 · Exploit
• https://debian.org/lts/security/2022/dla-3240 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43237 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01149 · Security Note
• https://ubuntu.com/security/CVE-2022-43241 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43239 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-43242 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43242 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36410 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43235 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-43242 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43253 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43238 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35452 · Vendor Advisory