[Git][security-tracker-team/security-tracker][master] CVE-2026-XXXX/libde265 - currently TEMP-0000000-62EEDC - GHSA-vm5w-mrw5-q329 not affecting bookworm

[Tobias Frost (@tobi)]

Tobias Frost pushed to branch master at Debian Security Tracker / security-tracker


Commits:
63f68799 by Tobias Frost at 2026-10-10T10:57:21+02:00
CVE-2026-XXXX/libde265 - currently TEMP-0000000-62EEDC - GHSA-vm5w-mrw5-q329 not affecting bookworm

The code was introduced later, with commit https://github.com/strukturag/libde265/commit/c7855dd9a0407f4b2c33661b99bf5a802fb7522d

(The pointer to the introducing commit is mentioned in the fixing
commit message, https://github.com/strukturag/libde265/commit/dd8d9ca065d86736f4c8460812f9cd0171415995:

Confirmed on bookworm that the code is not present.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -49057,8 +49057,10 @@ CVE-2025-12737 (The administrative operations within the Carbon Console do not a
 	NOT-FOR-US: WSO2
 CVE-2026-XXXX [GHSA-vm5w-mrw5-q329: Heap memory disclosure via incorrect luma plane fill in de265_image::fill_plane()]
 	- libde265 1.1.3-1
+	[bookworm] - libde265 <not-affected> (vulnerable code introduced later)
 	NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-vm5w-mrw5-q329
 	NOTE: Fixed by: https://github.com/strukturag/libde265/commit/dd8d9ca065d86736f4c8460812f9cd0171415995 (v1.1.3)
+	NOTE: introduced by: https://github.com/strukturag/libde265/commit/c7855dd9a0407f4b2c33661b99bf5a802fb7522d (v1.0.16)
 CVE-2026-XXXX [GHSA-xp3h-6f5r-8cxp: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free and Double Free in libde265]
 	- libde265 1.1.2-1
 	[trixie] - libde265 <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/63f68799890f34c829c3109b5a5970755eec788a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/63f68799890f34c829c3109b5a5970755eec788a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261010/17804306/attachment-0001.htm>