PT-2026-51028 · Struktur Ag · Libde265

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-49346

NVD

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in de265 image get buffer() (libde265/image.cc:128). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent fill image() call computes the real size using size t, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-49346

Affected Products

Libde265

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-49346 · Security Note
• https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8 · Note
• https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86 · Note