{"id":"CVE-2026-88373","details":"libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.","modified":"2026-09-26T08:04:16.464162Z","published":"2026-09-24T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88373.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88373.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88373"},{"type":"REPORT","url":"https://github.com/strukturag/libde265/issues/534"},{"type":"FIX","url":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libde265","events":[{"introduced":"0"},{"fixed":"f8d324914e43d92af23614f22959cf9eee7bf9ea"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.1.1","v1.1.0","v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.0","v0.5","v0.4","v0.3","v0.2","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88373.json","vanir_signatures_modified":"2026-09-26T08:04:16Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","target":{"file":"libde265/nal-parser.cc","function":"NAL_unit::append"},"deprecated":false,"digest":{"function_hash":"255385923216439472455638316959366821577","length":221},"id":"CVE-2026-88373-12ca349c"},{"source":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","target":{"file":"libde265/nal-parser.cc"},"deprecated":false,"digest":{"line_hashes":["3242133267139686616912635448546292995","16615410815678918921709708983001822282","194902169645804356998119798986692051707","21005841508062009509078052880976127404","87300067293968751043406955926255579143","296065977130926651254051814378375760333","52984026673165571099052791394777410568","54538939867259705890666323558310846399","75998044433876006430473403078358881382","144366662403917398883341374467357781959","239000578338092464502711869079552681870"],"threshold":0.9},"id":"CVE-2026-88373-5cbe4501","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","target":{"file":"libde265/de265.cc"},"deprecated":false,"digest":{"line_hashes":["37145247735219515142162354147003502504","282749968757122942420425401358609194558","85165842596296526964377019323850497720","46723026545437911667326083604498329941"],"threshold":0.9},"id":"CVE-2026-88373-75d3efe1","signature_type":"Line"},{"id":"CVE-2026-88373-7dd7eb59","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","target":{"file":"libde265/de265.h"},"deprecated":false,"digest":{"line_hashes":["129142225642975902650895074117704864918","247438194840847496993989169751799663657","340200159891328648055333106756476472002","116496317292592442618011489774068395459","152864479114209871358731959321667903990","41745890224911854882102475469429997525","62585529333823690965320756352174230806"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"141034166195477299732581890686750692958","length":198},"id":"CVE-2026-88373-a5d861ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","target":{"file":"libde265/nal-parser.cc","function":"NAL_unit::set_data"}},{"deprecated":false,"digest":{"function_hash":"338284878110286907676767796180670302543","length":533},"id":"CVE-2026-88373-ae39ffd5","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","target":{"file":"libde265/nal-parser.cc","function":"NAL_Parser::push_NAL"}},{"signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","target":{"file":"libde265/de265.cc","function":"de265_get_error_text"},"deprecated":false,"digest":{"function_hash":"279344025318958388157042887009651774854","length":5587},"id":"CVE-2026-88373-d0bed3a8","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}