VDB

CVE-2026-49337

CVE-2026-49337 PUBLISHED CVSS 4.3 MEDIUM

Reported by GitHub_M · Published June 19, 2026

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.

Risk Scores

CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected Products

VendorProductVersions
strukturaglibde265< 1.0.20
alpinelibde2650, 0, 0
strukturaglibde265< 1.0.20, < 1.0.20

Timeline

  • Jun 19, 2026 CVE Published
  • Jun 20, 2026 Coalition ESS Score
  • Jun 22, 2026 CVE Updated
  • Jun 23, 2026 EPSS Score
  • Jun 23, 2026 Security Advisory
  • Aug 7, 2026 EPSS Score
  • Aug 24, 2026 EPSS Score
  • Aug 27, 2026 EPSS Score
  • Sep 1, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
Open in Interactive Console →
$ Console Community · 100/wk Open console ›