CVE-2026-49346 Details
Description
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.
A heap buffer overflow vulnerability has been identified in libde265, an open-source H.265 video codec implementation, in versions prior to 1.1.0. The issue arises in the function 'de265_image_get_buffer()' due to a signed integer overflow caused by large SPS dimensions and 16-bit bit depth in a crafted H.265 bitstream. This overflow miscalculates the plane allocation size, wrapping it to approximately 1 KB. However, the subsequent 'fill_image()' call writes around 4 GB into this undersized heap buffer, leading to a crash and a high potential for code execution.
Users are advised to update to libde265 version 1.1.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8 | [email protected] | Patch |
| https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| struktur libde265 | < 1.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |