CVE-2026-49346: libde265 H.265 Integer Overflow & Heap Buffer Overflow

Technical summary

CVE-2026-49346 stems from a signed integer overflow in the de265_image_get_buffer() function (libde265/image.cc:128) when processing H.265 bitstreams with large SPS (Sequence Parameter Set) dimensions and 16-bit bit depth. The overflow wraps the calculated plane allocation size to approximately 1 KB. However, the subsequent fill_image() call recalculates the actual required size using unsigned 32-bit arithmetic, writing roughly 4 GB of data into the undersized heap buffer. This type mismatch between signed and unsigned integer calculations creates a classic heap buffer overflow vulnerability (CWE-190: Integer Overflow or Wraparound).

Business impact

Any application embedding libde265 to decode user-supplied or untrusted H.265 video content faces a direct denial-of-service risk through application crashes. In cases where an attacker controls heap layout or application logic, the overflow could enable arbitrary code execution, though this requires additional exploitation techniques. Organizations streaming or transcoding video content, or shipping desktop video players, face the greatest immediate risk of service disruption and potential lateral compromise.

Affected systems

libde265 prior to version 1.1.0 is affected. This includes all stable and development releases before the patched version. Identify affected systems by checking the installed libde265 version—typically found in video player software, transcoding pipelines, and media server applications. Verify vendor distribution: the affected product is listed as 'struktur libde265'.

Exploitability

Exploitation requires user interaction: an attacker must craft a malicious H.265 video file and convince a user to open it in an application that uses the vulnerable library. The attack has a low complexity—only specially formatted SPS parameters are needed, no authentication or privileges are required. The CVSS 3.1 score of 7.1 (HIGH) reflects the combination of network attack surface, user interaction requirement, and impact to confidentiality (low) and availability (high).

Remediation

Upgrade libde265 to version 1.1.0 or later. For applications statically linking libde265, rebuild against the patched library version. Verify the update resolves the signed integer overflow in de265_image_get_buffer(). Until patching is complete, avoid processing H.265 video from untrusted sources in production environments.

Patch guidance

Version 1.1.0 of libde265 is the patched release. Consult the upstream GitHub repository (struktur/libde265) for release notes and verification instructions. Organizations should test the patched version in a staging environment before production deployment, especially in video transcoding or streaming workflows. Confirm that all dependent applications have been updated to link the patched library version.

Detection guidance

Monitor application logs for unexpected crashes or segmentation faults when processing H.265 video files, particularly if correlated with files from external or untrusted sources. Endpoint detection tools may flag heap corruption patterns. Code review and static analysis can identify uses of libde265 in custom applications. Review package manifests and dependency lists in your software supply chain for libde265 version pinning—enforce minimum version 1.1.0 in build and deployment pipelines.

Why prioritize this

While no public exploit code has been reported (KEV status: not added), the vulnerability combines a low-complexity exploitation path, network attack surface, and high impact to system availability. Any application processing untrusted H.265 video should prioritize patching. Prioritize systems that process user-uploaded or internet-sourced video content over internal-only deployments.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: (1) network-based attack vector with no required privileges or special access; (2) user interaction requirement (user must open a malicious video), which moderates exploitability; (3) low integrity impact but high availability impact (denial of service). The score is driven by the guaranteed service disruption via crash, though the overflow theoretically enables more severe outcomes under specific heap conditions.

Frequently asked questions