CVE-2026-49346

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49346
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49346.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49346
Aliases
  • GHSA-vv8h-932h-7r86
Downstream
Published
2026-06-19T20:12:14.958Z
Modified
2026-07-22T00:05:47.540043Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVSS Calculator
Summary
libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow
Details

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in de265_image_get_buffer() (libde265/image.cc:128). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent fill_image() call computes the real size using size_t, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49346.json",
    "cwe_ids": [
        "CWE-190"
    ]
}
References

Affected packages

Git / github.com/strukturag/libde265

Affected ranges

Type
GIT
Repo
https://github.com/strukturag/libde265
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f0e5137ee10af674dcb5ac8ed5d02f5a102225af
Fixed
8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8
Database specific 
{
    "cpe": "cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1
v0.2
v0.3
v0.4
v0.5
v1.*
v1.0.0
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9

Database specific

vanir_signatures_modified 
"2026-07-22T00:05:47Z"
vanir_signatures 
[
    {
        "target": {
            "function": "de265_alloc_image_plane",
            "file": "libde265/image.cc"
        },
        "id": "CVE-2026-49346-181472e3",
        "digest": {
            "function_hash": "147176829153161336648682223151634823940",
            "length": 677.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8"
    },
    {
        "target": {
            "function": "de265_image_get_buffer",
            "file": "libde265/image.cc"
        },
        "id": "CVE-2026-49346-6d561673",
        "digest": {
            "function_hash": "220896103505704885453970870779977515427",
            "length": 1581.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8"
    },
    {
        "target": {
            "file": "libde265/image.cc"
        },
        "id": "CVE-2026-49346-d50716d3",
        "digest": {
            "line_hashes": [
                "40419494937393674600294107144927266072",
                "156922661229603807886362443071351210804",
                "53503243586850819582866350272843652762",
                "105849735730209843405452299646372436586",
                "158579856250421710788452350270053597028",
                "243112116629678069343442656435259157306",
                "294921012078188619465331146337799045125",
                "139334386095805604088308753228045074448",
                "180357919016290568130507640005188000509",
                "301556938540835024047261927703593202767",
                "323580550810438177819009151310801803875",
                "64328521247580353150500489569973783054",
                "163275754284412294267553892602476623757",
                "164694675671664028336554888511015544110",
                "217251924201609092691121625159051031235",
                "327970011921408291146651594903797011742",
                "245197746329202587358259280937636139543",
                "60778642710236278279347018951182445199",
                "98027627046479612848427176905018154381",
                "148097323458834907932890877352048530562",
                "127049026898825232322328712116143549969",
                "177487694103956539831751194884368909507",
                "337461779018106887904005291466090703883",
                "83696827308546504434313158755080953390",
                "259577027533737059637700871489159236989",
                "224358653257448369354798708894963474510",
                "26005099948866771816010327762246081459",
                "166067409949975448517827824503160891504",
                "86852089727427477278448765554073481495",
                "302451293703990359034678349436840464347",
                "46103688717465483198793551169325083650",
                "178483228682233669256174747459907360462",
                "237026597237789952175212522401952620260",
                "157641268384319132093917912546086177873",
                "125239476170766842250291007635806972169"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49346.json"