PT-2026-51028 · Struktur Ag · Libde265

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-49346

NVD

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in de265 image get buffer() (libde265/image.cc:128). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent fill image() call computes the real size using size t, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2026-49346

Produtos afetados

Libde265

Referências · 3

• https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8 · Nota
• https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-49346 · Nota de Segurança