OSV-2026-1054

See a problem?
Import Source
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libhevc/OSV-2026-1054.yaml
JSON Data
https://api.osv.dev/v1/vulns/OSV-2026-1054
Published
2026-07-12T00:03:00Z
Modified
2026-07-12T00:03:00Z
Summary
Heap-buffer-overflow in ihevcd_cabac_decode_bins_tunary
Details

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533053032

Crash type: Heap-buffer-overflow READ 4
Crash state:
ihevcd_cabac_decode_bins_tunary
ihevcd_parse_transform_tree
ihevcd_parse_transform_tree
References

Affected packages

OSS-Fuzz / libhevc

Package

Name
libhevc
Purl
pkg:generic/libhevc

Affected ranges

Type
GIT
Repo
https://github.com/ittiam-systems/libhevc.git
Events
Introduced
e7d529d2718974b5bcdfab4d2376a09764349afa
Fixed
5b574436c3cb4796c41164a33659e981616c74d3

Affected versions

v1.*
v1.8.2
v1.8.4
v1.8.5

Ecosystem specific 

{
    "severity": "MEDIUM"
}

Database specific

fixed_range 
"0ec4164e6a387367910e458c0ef26de60217f0c8:5b574436c3cb4796c41164a33659e981616c74d3"
introduced_range 
"a0296d9951f437a255190beb11d24fdae3d219ee:646ee9988888336da6f762788c97a87b74b7578d"
source 
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libhevc/OSV-2026-1054.yaml"