CVE-2026-49337: libde265 Buffer Overflow Vulnerability

CVE-2026-49337 Overview

CVE-2026-49337 affects libde265, an open source implementation of the H.265 (HEVC) video codec maintained by Struktur AG. A crafted sequence of H.265 Network Abstraction Layer (NAL) units triggers attacker-controlled unbounded heap growth in decoder_context::read_slice_NAL() at libde265/decctx.cc:481. The function attaches slice headers to a finished picture object with no active image unit. The retained headers are never freed until the picture is released, which may not occur during continuous streaming. Versions prior to 1.0.20 are vulnerable, and the issue is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
Remote attackers can exhaust process memory in applications that decode untrusted H.265 streams, causing denial of service through sustained streaming sessions.

Affected Products

libde265 versions prior to 1.0.20
Applications and media frameworks that link against vulnerable libde265 builds
Streaming clients and video processing pipelines decoding H.265 content

Discovery Timeline

2026-06-19 - CVE-2026-49337 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49337

Vulnerability Analysis

The defect resides in decoder_context::read_slice_NAL() within libde265/decctx.cc. When the decoder processes a slice NAL unit, it appends the parsed slice header to the current picture object via add_slice_segment_header(). The vulnerability occurs when the target picture is already finished and lacks an active image unit. The decoder still attaches the header rather than rejecting or freeing it. An attacker controls the count and size of slice headers attached to the orphan picture by crafting NAL unit sequences. Each retained header consumes heap memory that the decoder never releases until the picture itself is freed.

Root Cause

The root cause is missing lifecycle validation before add_slice_segment_header() is invoked. The function does not check whether an image unit is active for the target picture. Combined with the absence of an upper bound on retained headers, this matches [CWE-770]: Allocation of Resources Without Limits or Throttling.

Attack Vector

Exploitation requires a victim to decode a crafted H.265 stream from an attacker-controlled source. User interaction is required, such as opening a media file or connecting to a streaming endpoint. The attack is network-reachable and requires no privileges. Continuous streaming amplifies impact because the orphan picture is never released, allowing memory to grow without bound.

text

// Patch excerpt from libde265/decctx.cc removing the unconditional attach
     shdr->entry_point_offset[i] -= skipped;
   }
 
-  this->img->add_slice_segment_header(shdr);
-
-
-
   // --- start a new image if this is the first slice ---
 
   if (shdr->first_slice_segment_in_pic_flag) {
// Source: https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9

The patch removes the unconditional call to add_slice_segment_header(shdr) and relocates header attachment to a code path that validates an active image unit, preventing orphan retention.

Detection Methods for CVE-2026-49337

Indicators of Compromise

Sustained, monotonic heap growth in processes linked against libde265 while decoding H.265 streams
Process termination by the out-of-memory (OOM) killer on hosts running media services or transcoders
Anomalous H.265 NAL unit sequences containing repeated slice segments without corresponding picture boundaries

Detection Strategies

Inventory binaries and containers that bundle libde265 and compare versions against 1.0.20 using software composition analysis tools
Inspect H.265 inputs for malformed slice segment sequences lacking first_slice_segment_in_pic_flag transitions
Correlate memory pressure alerts with active media decoding sessions to identify suspect streams

Monitoring Recommendations

Track resident set size (RSS) and heap allocations of decoder processes and alert on linear growth during streaming
Log H.265 stream sources and durations to attribute resource exhaustion events to specific peers or URLs
Forward decoder crash and OOM events to a centralized SIEM for correlation across hosts

How to Mitigate CVE-2026-49337

Immediate Actions Required

Upgrade libde265 to version 1.0.20 or later across all systems and container images
Rebuild and redeploy downstream applications that statically link libde265
Restrict acceptance of H.265 streams from untrusted sources until patching completes

Patch Information

Version 1.0.20 patches the issue. The fix is committed in strukturag/libde265 commit 683cb9f and described in GHSA-g5hj-rf9f-7vxm. Distribution maintainers should backport the patch to packaged versions still in support.

Workarounds

Enforce per-process memory limits on decoder workers using cgroups or systemd MemoryMax to contain runaway growth
Terminate and restart long-running decoder sessions on a schedule to release any retained picture objects
Validate or transcode incoming H.265 streams through a hardened gateway before delivery to vulnerable consumers

bash

# Example systemd unit hardening to contain decoder memory growth
[Service]
MemoryMax=512M
MemoryHigh=384M
Restart=on-failure
RestartSec=5s