CVE-2026-49295

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b	Patch
https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594	Exploit Mitigation Vendor Advisory
https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) libde265 es una implementación de código abierto del códec de video h.265. Antes de la versión 1.0.20, un flujo de bits H.265 manipulado puede causar una escritura fuera de límites de un array en ’decoder_context::process_reference_picture_set()’ (’libde265/decctx.cc:1376’). La causa raíz es una falta de comprobación de límites agregada en las entradas del conjunto de imágenes de referencia a corto plazo predichas. Los tamaños de las listas individuales se validan, pero el recuento combinado después de la construcción del RPS predicho puede exceder el array ’PocStFoll’ de 16 entradas, escribiendo en el índice 16. La versión 1.0.20 corrige el problema.

Information

Published : 2026-06-19 21:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-49295

Mitre link : CVE-2026-49295

CVE.ORG link : CVE-2026-49295

JSON object : View

Products Affected

struktur

libde265

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-49295", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49295", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T17:18:41.430511Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "strukturag", "product": "libde265", "versions": [{"status": "affected", "version": "< 1.0.20"}]}]}], "published": "2026-06-19T21:17:01.590", "references": [{"url": "https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue."}, {"lang": "es", "value": "libde265 es una implementaci\u00f3n de c\u00f3digo abierto del c\u00f3dec de video h.265. Antes de la versi\u00f3n 1.0.20, un flujo de bits H.265 manipulado puede causar una escritura fuera de l\u00edmites de un array en \u2019decoder_context::process_reference_picture_set()\u2019 (\u2019libde265/decctx.cc:1376\u2019). La causa ra\u00edz es una falta de comprobaci\u00f3n de l\u00edmites agregada en las entradas del conjunto de im\u00e1genes de referencia a corto plazo predichas. Los tama\u00f1os de las listas individuales se validan, pero el recuento combinado despu\u00e9s de la construcci\u00f3n del RPS predicho puede exceder el array \u2019PocStFoll\u2019 de 16 entradas, escribiendo en el \u00edndice 16. La versi\u00f3n 1.0.20 corrige el problema."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFAFB5DC-69ED-439B-8046-9F12CA49D5AE", "versionEndExcluding": "1.0.20"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}