CVE-2026-49337
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth.
Risk Assessment
The organization may be vulnerable to attacks that exploit unbounded heap growth, potentially leading to resource exhaustion and application crashes.
Recommendation
It is recommended to update libde265 to version 1.0.20 or later to mitigate this vulnerability.
Other vulnerabilities in libde265
See all- CVE-2025-61147Low
A segmentation fault was discovered in the libde265 library (commit d9fea9d) in the decoder_context::compute_framedrop_table() function. This vulnerability may cause crashes in applications using this library.
- CVE-2026-45383Medium
Vulnerability in the libde265 library (H.265 codec implementation) prior to version 1.0.19. A heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` that can be triggered by crafted HEVC streams with WPP, leading to crashes or potentially code execution.
- CVE-2026-45382Medium
In libde265 prior to version 1.0.19, there is a heap-buffer-overflow read vulnerability. The flaw in `decoder_context::decode_slice_unit_tiles` allows reading 4 bytes past the allocated buffer via malformed PPS data.
Original NVD description (English source)
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.