PT-2026-51027 · Struktur Ag · Libde265

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-49337

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes decoder context::read slice NAL() (libde265/decctx.cc:481) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-49337

Produtos afetados

Libde265

Referências · 3

• https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm · Nota
• https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-49337 · Nota de Segurança