CVE-2026-49295

Analyzed Analyzed - Analysis Complete

Heap Overflow in libde265 Video Codec

Publication date: 2026-06-19

Last updated on: 2026-06-26

Assigner: GitHub, Inc.

Description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-06-26

Generated

2026-07-11

AI Q&A

2026-06-20

EPSS Evaluated

2026-07-10

NVD

CVE-2026-49295

Affected Vendors & Products

Vendor	Product	Version / Range
struktur	libde265	to 1.0.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in libde265, an open source implementation of the H.265 video codec. Before version 1.0.20, a specially crafted H.265 bitstream can trigger an out-of-bounds array write in the function decoder_context::process_reference_picture_set().

The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Although individual list sizes are validated, the combined count after constructing the predicted reference picture set can exceed the size of the PocStFoll array, which has 16 entries. This leads to writing beyond the array boundary at index 16.

This issue was fixed in version 1.0.20 of libde265.

Impact Analysis

Exploitation of this vulnerability can cause an out-of-bounds write, which may lead to application crashes or potentially allow an attacker to execute arbitrary code or cause denial of service.

According to the CVSS score (7.1), the vulnerability has a high impact on availability (A:H) and a low impact on integrity (I:L), with no impact on confidentiality (C:N). It can be exploited remotely without privileges but requires user interaction.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade libde265 to version 1.0.20 or later, where the issue has been patched.

Hi! I’m here to help you understand CVE-2026-49295. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70