PT-2026-51027 · Struktur Ag · Libde265

Dyingc · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-49337

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions libde265 versions prior to 1.0.20

Description An issue in the h.265 video codec implementation allows a crafted sequence of H.265 NAL units to cause the decoder context::read slice NAL() function to attach slice headers to a finished picture object that lacks an active image unit. This leads to attacker-controlled unbounded heap growth, as the retained headers are not freed until the picture is released, which may not occur during continuous streaming.

Recommendations Update to version 1.0.20.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-49337

Affected Products

Libde265

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-49337 · Security Note
• https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm · Note
• https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9 · Note
• https://twitter.com/infoflowcloud/status/2068089127380168720 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2068103787609276596 · Twitter Post
• https://twitter.com/CVEnew/status/2068087580332089416 · Twitter Post