Security readout for executives and security teams
Plain-English summary
CVE-2022-43243 is a denial-of-service flaw in libde265 v1.0.8. A crafted video file can trigger a heap buffer overflow during decoding, potentially crashing software or services that process the file. The published impact is availability loss, not data theft or privilege escalation.
Executive priority
Treat this as a practical availability risk, not a confirmed data breach risk. Prioritize patching systems that process external video at scale or support customer-facing workflows, because a crafted file could disrupt service availability.
Technical view
The issue is a CWE-787 heap-buffer-overflow in libde265 v1.0.8, specifically ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. CVSS 3.1 is 6.5 with network attack vector, low complexity, no privileges, user interaction required, unchanged scope, and high availability impact only.
Likely exposure
Exposure is most likely where libde265 is used to decode untrusted video files, including media processing, upload pipelines, preview generation, or endpoints where users can open supplied videos. The bundle does not identify affected downstream products beyond libde265 and Debian packages.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not marked KEV. Abuse depends on getting a vulnerable decoder to process a crafted video file. The supported impact is denial of service through a crash or availability disruption.
Researcher notes
Evidence supports a heap buffer overflow in a specific SSE motion-compensation path and DoS impact. The source bundle does not provide exploit maturity, fixed upstream version details, or affected downstream product mapping, so validation should focus on package provenance and decoding exposure.
Mitigation direction
- Apply the relevant Debian libde265 security update where Debian packages are used.
- For non-Debian builds, check libde265 maintainer or vendor guidance for fixed versions.
- Reduce exposure by limiting processing of untrusted video until patched.
- Run video decoding workloads with least privilege and isolation where practical.
Validation and detection
- Inventory systems and containers for libde265 v1.0.8 or vulnerable distro packages.
- Confirm whether applications process user-supplied or externally sourced video files.
- Verify Debian systems include the DSA-5346 or DLA-3280-1 security update.
- Review crash telemetry for libde265 decoder failures around untrusted media processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-43243 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/strukturag/libde265/issues/339CVE reference
- [debian-lts-announce] 20230124 [SECURITY] [DLA 3280-1] libde265 security updateCVE reference · mailing-list
- DSA-5346CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.