CVE-2026-49337: libde265 H.265 Decoder Memory Exhaustion Denial of Service

Technical summary

The vulnerability exists in the `decoder_context::read_slice_NAL()` function in libde265/decctx.cc at line 481. The flaw occurs when a sequence of H.265 NAL (Network Abstraction Layer) units is crafted such that slice headers are attached to a picture object that has already finished decoding and contains no active image unit. These headers are retained in memory and not freed until the picture object itself is released. In continuous streaming scenarios, picture release may be indefinitely delayed, causing slice headers to accumulate without bound. This is a classic resource exhaustion vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling). The issue affects all versions of libde265 prior to 1.0.20.

Business impact

For organizations and users relying on libde265 for H.265 video decoding—such as video players, streaming services, or embedded systems processing video content—this vulnerability poses a denial-of-service risk. An attacker who can deliver a crafted video file can exhaust memory on the target system, causing the decoder process (and potentially the entire application or device) to become unresponsive or crash. The impact is heightened in scenarios with limited memory (mobile devices, embedded systems) or where video streams are processed from untrusted sources. No confidentiality or integrity breach occurs, but service availability is compromised.

Affected systems

Any system or application using libde265 versions prior to 1.0.20 is affected. This includes video players, streaming clients, and embedded devices that rely on libde265 for H.265 (HEVC) video playback. The vulnerability requires that a user or process actively opens or plays a malicious video file, so exposure depends on whether the system processes video from untrusted sources.

Exploitability

Exploitability is moderate. An attacker must craft a specific sequence of H.265 NAL units and deliver it as a video file to a target. The attack vector is network-based (delivery of the malicious file) but requires user interaction (opening or playing the video). No authentication or special privileges are needed on the victim's system. The low CVSS score (4.3 MEDIUM) reflects the requirement for user action and the limited scope of impact (availability only). The crafting of the malicious video file requires understanding of the H.265 codec structure, placing this beyond casual script-kiddie attacks, though not beyond a determined adversary.

Remediation

Update libde265 to version 1.0.20 or later. This patch resolves the slice header attachment issue by preventing headers from being attached to finished picture objects with no active image unit. Organizations should inventory all systems and applications using libde265, prioritize environments processing video from untrusted sources, and apply the update in a coordinated manner. If immediate patching is not feasible, consider restricting video playback to trusted sources or disabling H.265 decoding until patched.

Patch guidance

Libde265 version 1.0.20 and later contain the fix. Consult the official libde265 project repository and release notes to verify patch availability for your platform and distribution. If libde265 is embedded in a larger application (media player, streaming client, etc.), check whether the application vendor has released an updated version incorporating the patched libde265 library. Verify the fix by confirming the version string and reviewing release notes before deploying to production.

Detection guidance

Monitor for signs of memory exhaustion in processes using libde265: sustained high memory usage, out-of-memory errors, or process crashes during video playback. Log and analyze any crashes in video decoding libraries. Network-based detection is challenging because the malicious input is embedded in a valid-looking video file; however, if the source of suspicious videos can be identified, blocking or quarantining them may limit exposure. Endpoint detection and response (EDR) tools can alert on memory exhaustion patterns in media player processes.

Why prioritize this

While the CVSS score is moderate (4.3), prioritization should account for context. If your organization processes video from untrusted sources (user-generated content, external streaming, automated video feeds), or if libde265 is widely deployed on resource-constrained devices, elevation to high priority is warranted. For organizations with strict control over video sources and abundant memory, risk is lower. The absence from the KEV catalog suggests active exploitation is not yet widespread, but the ease of patch deployment (version bump) argues for proactive updating rather than waiting for evidence of attacks.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), but required user interaction (UI:R). The impact is availability only (A:L; no confidentiality or integrity loss). The score appropriately captures that an attacker must deliver a file and a user must process it, but once that happens, uncontrolled memory consumption is straightforward to trigger. The moderate score should not be mistaken for low risk in high-exposure environments.

Frequently asked questions