QSN-8909-1: libde265 vulnerability
2026-10-08

Summary:
libde265 could be made to crash if it received specially crafted input.

Details:
It was discovered that libde265 did not properly validate certain crafted
H.265 bitstreams, leading to a NULL pointer dereference. An attacker could
possibly use this issue to cause libde265 to crash, resulting in a denial
of service.

Affected QuantaStor releases:
  6.9.1.001 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)
  6.9.0.464 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)
  6.8.6.015 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)
  6.8.5.018 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)
  6.8.4.038 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)
  6.8.3.018 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)
  6.8.2.002 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)
  6.8.1.007 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)
  6.8.0.205 jammy: libde265-0 1.0.8-1ubuntu0.3+esm1 (fixed in 1.0.8-1ubuntu0.3+esm3)

CVEs: CVE-2026-88373

References:
  https://ubuntu.com/security/notices/USN-8909-1