CVE-2026-49337

Deferred Deferred - Pending Action

Heap Overflow in libde265 Video Codec

Publication date: 2026-06-19

Last updated on: 2026-06-22

Assigner: GitHub, Inc.

Description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-06-22

Generated

2026-07-11

AI Q&A

2026-06-20

EPSS Evaluated

2026-07-10

NVD

CVE-2026-49337

Affected Vendors & Products

Vendor	Product	Version / Range
multicoreware	libde265	to 1.0.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability exists in libde265, an open source implementation of the H.265 video codec. Before version 1.0.20, a specially crafted sequence of H.265 NAL units causes the function decoder_context::read_slice_NAL() to incorrectly attach slice headers to a finished picture object that has no active image unit.

As a result, attacker-controlled unbounded heap growth occurs because the retained headers are never freed until the picture is released, which may not happen during continuous streaming.

This issue was fixed in version 1.0.20 of libde265.

Impact Analysis

The vulnerability can lead to unbounded heap growth controlled by an attacker, which may cause a denial of service (DoS) condition by exhausting system memory during continuous streaming.

The CVSS score of 4.3 indicates a low to medium severity impact, specifically affecting availability (A:L) without compromising confidentiality or integrity.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade libde265 to version 1.0.20 or later, as this version patches the issue.

Hi! I’m here to help you understand CVE-2026-49337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70