CVE-2026-49295: libde265 Out-of-Bounds Write in H.265 Video Decoder

Technical summary

CVE-2026-49295 is an out-of-bounds write vulnerability in libde265's `decoder_context::process_reference_picture_set()` function (libde265/decctx.cc:1376). The root cause is insufficient validation of the aggregate size of predicted short-term reference picture set (RPS) entries. While individual reference picture list sizes are checked during parsing, the combined count after RPS prediction construction can exceed the fixed 16-entry `PocStFoll` array boundary, permitting an out-of-bounds write at index 16 or beyond. This is a CWE-787 (Out-of-bounds Write) issue with CVSS v3.1 score 7.1 (HIGH severity), rated CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H.

Business impact

Organizations deploying libde265 in video streaming, transcoding, or playback services face availability and data integrity risks. A malicious or corrupted H.265 video file could trigger a crash (denial of service) or, in certain memory configurations, enable code execution via heap corruption. Media platforms, content delivery networks, surveillance systems, and any application processing untrusted video streams are at risk. The user-interaction requirement (UI:R) means the attack requires user action or automated processing of untrusted content, narrowing but not eliminating real-world exposure in public-facing video services.

Affected systems

libde265 versions prior to 1.0.20 are vulnerable. Any application, library, or service that bundles or links libde265 for H.265 decoding is affected, including media players, video transcoding pipelines, security cameras, and streaming applications. Both direct consumers (e.g., VLC plugins) and indirect consumers through dependency chains must be assessed. Verify the installed version of libde265 in your environment and check upstream dependencies in package managers (pip, npm, apt, homebrew, etc.).

Exploitability

Exploitation requires a network vector and user interaction, but presents moderate practical risk. An attacker crafts a malicious H.265 bitstream that violates the aggregate RPS constraint and delivers it via email, website, or streaming service. The victim (user or automated processing system) opens or plays the file, triggering the out-of-bounds write during decoding. The lack of authentication (PR:N) and low complexity (AC:L) mean no special privileges or setup are needed. Public proof-of-concept bitstreams are not confirmed in circulation, but the vulnerability is deterministic and reproducible by reverse engineering the codec specification and the patched code.

Remediation

Upgrade libde265 to version 1.0.20 or later immediately. For distributions and package managers, check for security updates in your repository (e.g., Ubuntu, Debian, Alpine, Fedora). For applications embedding libde265, coordinate with upstream maintainers or rebuild against the patched library. If immediate patching is not possible, restrict processing of H.265 streams from untrusted sources and monitor for abnormal decoder terminations or memory faults in your logging and alerting systems.

Patch guidance

libde265 version 1.0.20 adds an aggregate bounds check on predicted RPS entries before construction. To patch, retrieve version 1.0.20 or later from the official libde265 repository (https://github.com/strukturorg/libde265). Apply security updates via your package manager: `apt-get install libde265` (Ubuntu/Debian), `brew upgrade libde265` (macOS), or equivalent for your OS. Verify the patched version with `libde265 --version` or by linking verification in your build artifacts. For containerized deployments, rebuild images against the patched library and redeploy.

Detection guidance

Monitor for decoder crashes or segmentation faults when processing H.265 video. Review application logs, syslog, and core dumps for crashes in libde265 functions, particularly `process_reference_picture_set()`. Use address sanitizers (ASan, MSan) or memory debugging tools in test environments to catch out-of-bounds accesses. For network-based detection, inspect H.265 bitstream headers for malformed RPS data (nonstandard reference set sizes or predictions that exceed 16 entries), though this requires codec-aware packet inspection. Implement file sandboxing or isolated decoding processes to contain the impact of a crash.

Why prioritize this

This vulnerability merits priority for any organization handling H.265 video from untrusted sources. The HIGH CVSS score (7.1), combined with low exploit complexity and network exploitability, makes it a credible threat. The absence from CISA's KEV catalog suggests limited active exploitation in the wild, but the deterministic nature of the flaw and the simplicity of triggering it via malformed video files warrant proactive patching. Prioritize systems exposed to user-uploaded or publicly available video streams (e.g., CDNs, social media platforms, video hosting services) and safety-critical applications (surveillance, medical imaging).

Risk score, explained

CVSS 7.1 (HIGH) reflects a severe but not critical issue. The network attack vector (AV:N) and no-authentication requirement (PR:N) elevate risk, but the user-interaction requirement (UI:R) and lack of confidentiality impact (C:N) prevent a CRITICAL rating. The score emphasizes integrity impact (I:L) and high availability impact (A:H), meaning out-of-bounds writes can corrupt memory and crash the process. Organizations should weight this against their own risk tolerance: a video-streaming CDN faces higher concrete risk than an isolated research server.

Frequently asked questions