VDB
CVE-2026-49337
CVE-2026-49337
PUBLISHED
CVSS 4.3 MEDIUM
Reported by GitHub_M · Published June 19, 2026
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.
Risk Scores
CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| strukturag | libde265 | < 1.0.20 |
| alpine | libde265 | 0, 0, 0 |
| strukturag | libde265 | < 1.0.20, < 1.0.20 |
Timeline
- Jun 19, 2026 CVE Published
- Jun 20, 2026 Coalition ESS Score
- Jun 22, 2026 CVE Updated
- Jun 23, 2026 EPSS Score
- Jun 23, 2026 Security Advisory
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 27, 2026 EPSS Score
- Sep 1, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score