Security readout for executives and security teams
Plain-English summary
CVE-2022-43248 is a libde265 memory safety flaw that can crash software when it processes a specially crafted video file. The main business impact is denial of service in systems that decode untrusted HEVC/H.265 media. The sources do not show active exploitation.
Executive priority
Treat this as a moderate operational risk. Prioritize internet-facing or business-critical workflows that accept video uploads or attachments, then complete normal vulnerability management for endpoints and servers using libde265.
Technical view
libde265 v1.0.8 contains a heap-buffer-overflow in put_weighted_pred_avg_16_fallback in fallback-motion.cc. The CVE maps to CWE-787 and CVSS 3.1 score 6.5, with user interaction required and availability impact high. Debian published security updates in DLA 3280-1 and DSA-5346.
Likely exposure
Exposure is likely where libde265 is installed directly or as a dependency and processes untrusted video files. Media ingestion services, desktop viewers, or automated scanning pipelines may be relevant, but the provided sources do not enumerate affected downstream products.
Exploitation context
The documented attack condition is a crafted video file that triggers a denial of service during decoding. KEV is false, and the supplied sources do not report active exploitation or confidentiality/integrity impact.
Researcher notes
Evidence supports denial of service through a heap-buffer-overflow in a named libde265 fallback motion function. The affected version is stated as v1.0.8, but the bundle does not include full upstream fixed-version details beyond Debian advisories.
Mitigation direction
- Identify assets and applications using libde265, including transitive package dependencies.
- Apply Debian DLA 3280-1 or DSA-5346 security updates where applicable.
- For other distributions or builds, check libde265 vendor/project guidance for fixed versions.
- Restrict processing of untrusted HEVC/H.265 files until updates are applied.
- Monitor availability-impacting crashes in media processing workflows.
Validation and detection
- Confirm installed libde265 package or source version and whether v1.0.8 is present.
- Check OS advisory status against Debian DLA 3280-1 or DSA-5346 if applicable.
- Review media ingestion paths for user-supplied video decoding with libde265.
- Verify patched packages are deployed on systems that decode HEVC/H.265 content.
- Look for crash reports tied to libde265 decoding after external video files.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-43248 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/strukturag/libde265/issues/349CVE reference
- [debian-lts-announce] 20230124 [SECURITY] [DLA 3280-1] libde265 security updateCVE reference · mailing-list
- DSA-5346CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.