CVE-2026-49346

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8	Patch
https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86	Exploit Vendor Advisory
https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) libde265 es una implementación de código abierto del códec de video h.265. Antes de la versión 1.1.0, un flujo de bits H.265 manipulado con grandes dimensiones SPS y una profundidad de bits de 16 bits causa un desbordamiento de entero con signo en ’de265_image_get_buffer()’ (’libde265/image.cc:128’). El desbordamiento ajusta el tamaño de asignación del plano a un valor pequeño (~1 KB), pero la llamada subsiguiente a ’fill_image()’ calcula el tamaño real usando ’size_t’, escribiendo ~4 GB en el búfer de pila de tamaño insuficiente. La versión 1.1.0 corrige el problema.

Information

Published : 2026-06-19 21:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-49346

Mitre link : CVE-2026-49346

CVE.ORG link : CVE-2026-49346

JSON object : View

Products Affected

struktur

libde265

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-49346", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49346", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T14:04:49.752955Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "strukturag", "product": "libde265", "versions": [{"status": "affected", "version": "< 1.1.0"}]}]}], "published": "2026-06-19T21:17:01.847", "references": [{"url": "https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue."}, {"lang": "es", "value": "libde265 es una implementaci\u00f3n de c\u00f3digo abierto del c\u00f3dec de video h.265. Antes de la versi\u00f3n 1.1.0, un flujo de bits H.265 manipulado con grandes dimensiones SPS y una profundidad de bits de 16 bits causa un desbordamiento de entero con signo en \u2019de265_image_get_buffer()\u2019 (\u2019libde265/image.cc:128\u2019). El desbordamiento ajusta el tama\u00f1o de asignaci\u00f3n del plano a un valor peque\u00f1o (~1 KB), pero la llamada subsiguiente a \u2019fill_image()\u2019 calcula el tama\u00f1o real usando \u2019size_t\u2019, escribiendo ~4 GB en el b\u00fafer de pila de tama\u00f1o insuficiente. La versi\u00f3n 1.1.0 corrige el problema."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8290F95-BF35-4C0A-A314-D8B0CBB5760E", "versionEndExcluding": "1.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}