CVE-2026-49295: libde265 Buffer Overflow Vulnerability

CVE-2026-49295 Overview

CVE-2026-49295 is an out-of-bounds write vulnerability [CWE-787] in libde265, an open source implementation of the H.265 (HEVC) video codec. A crafted H.265 bitstream triggers the flaw in decoder_context::process_reference_picture_set() at libde265/decctx.cc:1376. The library validates individual reference picture set list sizes but fails to enforce an aggregate bound after predicted reference picture set (RPS) construction. The combined count can exceed the fixed 16-entry PocStFoll array, writing at index 16. Version 1.0.20 patches the issue.

Critical Impact
A remote attacker can deliver a malicious H.265 video file that causes memory corruption, leading to crashes or potential code execution in applications using libde265 for video decoding.

Affected Products

libde265 versions prior to 1.0.20
Applications and media players bundling libde265 for H.265/HEVC decoding
Downstream Linux distributions and container images shipping vulnerable libde265 builds

Discovery Timeline

2026-06-19 - CVE-2026-49295 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49295

Vulnerability Analysis

The vulnerability resides in libde265's reference picture set processing logic. H.265 decoders maintain reference pictures used to predict future frames, tracked in fixed-size arrays defined by MAX_NUM_REF_PICS (16 entries). The PocStFoll array stores Picture Order Count values for short-term follow references.

During predicted RPS construction, the decoder appends the current picture delta to an existing source set. While individual list sizes (NumNegativePics, NumPositivePics) are checked, the sum stored in NumDeltaPocs is not validated against the array capacity. When a crafted bitstream produces a combined count exceeding 16, the loop writes past the array boundary.

Root Cause

The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. The function trusts that bounded inputs produce bounded output, ignoring the additive nature of predicted RPS construction. Writing at index 16 of a 16-entry array corrupts adjacent stack or heap memory depending on allocation context.

Attack Vector

Exploitation requires an attacker to deliver a malicious H.265 video stream to a target using libde265. Delivery paths include media files served over HTTP, embedded video in web content, email attachments, or messaging applications using HEVC. User interaction is required to open or render the malicious media.

text

// Security patch in libde265/refpic.cc
// Source: https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b

   out_set->compute_derived_values();
 
+  // The unused short-term references are all collected into a single PocStFoll array
+  // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set).
+  // While each individual list is bounded above, the predicted-RPS construction can
+  // append the current-picture delta to an already-full source set, pushing the
+  // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds
+  // write when filling PocStFoll.
+  if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) {
+    out_set->NumNegativePics = 0;
+    out_set->NumPositivePics = 0;
+    out_set->NumDeltaPocs = 0;
+    out_set->NumPocTotalCurr_shortterm_only = 0;
+
+    errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false);
+    return false;
+  }
+
   return true;
 }

The patch adds an explicit check rejecting any RPS where NumDeltaPocs exceeds MAX_NUM_REF_PICS, zeroing the counts and returning a warning instead of proceeding to the unsafe write.

Detection Methods for CVE-2026-49295

Indicators of Compromise

Process crashes or segmentation faults in applications loading H.265 content via libde265
DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED warnings emitted by patched builds when scanning historical files
Unexpected child process termination in media servers, browsers, or thumbnail generators handling HEVC input

Detection Strategies

Inventory binaries and containers linking libde265 versions below 1.0.20 using software composition analysis tools
Monitor endpoint telemetry for crashes of media-handling processes correlated with H.265 file access
Inspect untrusted HEVC streams in sandboxed environments before delivery to end users

Monitoring Recommendations

Track file write and execution events on processes that decode video content
Alert on abnormal exit codes or memory access violations in media frameworks bundling libde265
Forward video decoder warnings and error logs to centralized log analytics for correlation

How to Mitigate CVE-2026-49295

Immediate Actions Required

Upgrade libde265 to version 1.0.20 or later across all systems and dependent applications
Identify and rebuild downstream packages, container images, and bundled software that statically link libde265
Restrict processing of H.265 content from untrusted sources until patched builds are deployed

Patch Information

The fix is committed in libde265 commit 691f3a3c and released in version 1.0.20. Additional context is available in the GitHub Security Advisory GHSA-g2rg-wj66-w594.

Workarounds

Block or filter H.265/HEVC video content at network egress and email gateways where decoding is not required
Run media-decoding workloads in sandboxed or isolated processes with restricted file system and network access
Disable automatic media preview and thumbnail generation in file managers and messaging clients

bash

# Verify installed libde265 version on Linux systems
dpkg -l | grep libde265
rpm -qa | grep libde265

# Upgrade on Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libde265-0

# Upgrade on RHEL/Fedora
sudo dnf upgrade libde265

# Confirm version is 1.0.20 or later
ldconfig -p | grep libde265