CVE-2026-49346: libde265 Buffer Overflow Vulnerability

CVE-2026-49346 Overview

CVE-2026-49346 is an integer overflow vulnerability [CWE-190] in libde265, an open source implementation of the H.265 video codec. A crafted H.265 bitstream with large Sequence Parameter Set (SPS) dimensions and 16-bit bit depth triggers a signed integer overflow inside de265_image_get_buffer() at libde265/image.cc:128. The overflow wraps the plane allocation size to roughly 1 KB. The subsequent fill_image() call then computes the real size using size_t and writes approximately 4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

Critical Impact
A crafted H.265 file processed by an unpatched libde265 build produces a heap buffer overflow that reliably crashes the decoder and can corrupt adjacent memory.

Affected Products

libde265 versions prior to 1.1.0
Applications and media frameworks that bundle vulnerable libde265 builds
Downstream H.265 decoders linking the affected library

Discovery Timeline

2026-06-19 - CVE-2026-49346 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49346

Vulnerability Analysis

The vulnerability resides in image plane allocation logic inside de265_image_get_buffer(). The function computes a stride and height using signed int arithmetic, then multiplies them to size the heap allocation. When SPS dimensions are large and the bit depth is 16 bits, the multiplication overflows a 32-bit signed integer and wraps to a small positive value. The allocator returns a buffer of roughly 1 KB. The decoder then proceeds to fill_image(), which recomputes the real plane size using size_t arithmetic and writes approximately 4 GB of pixel data into the undersized buffer. The result is a heap buffer overflow during decode of an attacker-supplied H.265 stream.

Root Cause

The root cause is mixed integer width arithmetic. stride * height is evaluated as int, while consumers of the resulting buffer compute the same product as size_t. The two values diverge once stride * height exceeds INT32_MAX, producing an allocation that is smaller than the data subsequently written.

Attack Vector

An attacker delivers a crafted H.265 bitstream to a vulnerable decoder, typically through a media file, a web video element, or a streaming endpoint. User interaction is required to open or load the content. Successful exploitation corrupts the heap and crashes the host process.

text

                                            void* inputdata, int inputstride, void *userdata)
 {
   int alignment = STANDARD_ALIGNMENT;
-  int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment;
-  int height = img->get_height(cIdx);
+  uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment;
+  uint32_t height = img->get_height(cIdx);

-  uint8_t* p = static_cast<uint8_t*>(ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING));
+  // size computed in size_t: stride*height can exceed UINT32_MAX for large planes
+  uint8_t* p = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(stride) * height + MEMORY_PADDING));

   if (p==nullptr) { return nullptr; }

Source: GitHub commit 8a1b5cf. The patch widens stride and height to uint32_t and casts to size_t before multiplication, so the allocation size matches the size later written by fill_image().

Detection Methods for CVE-2026-49346

Indicators of Compromise

Crash dumps in processes linking libde265 with faulting addresses inside heap allocations sized near 1 KB.
H.265 media files with SPS structures declaring unusually large pic_width_in_luma_samples or pic_height_in_luma_samples combined with bit_depth_luma_minus8 of 8 (16-bit).
Unexpected termination of media players, browsers, or transcoders shortly after loading an H.265 asset.

Detection Strategies

Inventory binaries and containers for libde265 versions below 1.1.0 using software composition analysis tools.
Inspect H.265 SPS headers at ingest and flag streams declaring 16-bit depth with extreme dimensions.
Enable AddressSanitizer or heap allocator hardening in test pipelines to surface the overflow during fuzzing of suspicious samples.

Monitoring Recommendations

Alert on repeated crashes of processes that handle untrusted media, especially browsers, media servers, and transcoding workers.
Monitor outbound delivery of H.265 content for anomalous bit depth and resolution combinations.
Track third-party dependency manifests and rebuild pipelines for projects that vendor libde265.

How to Mitigate CVE-2026-49346

Immediate Actions Required

Upgrade libde265 to version 1.1.0 or later across all systems, containers, and bundled applications.
Rebuild and redeploy downstream products that statically link libde265.
Block ingest of untrusted H.265 content in workflows until patched builds are confirmed in production.

Patch Information

The fix is committed in GitHub commit 8a1b5cf and released in libde265 1.1.0. Details are published in GitHub Security Advisory GHSA-vv8h-932h-7r86. The patch changes stride and height to uint32_t and casts to size_t prior to multiplication, eliminating the overflow.

Workarounds

Disable or remove H.265 decoding support in applications that cannot be upgraded immediately.
Validate H.265 SPS dimensions and bit depth before passing streams to the decoder, rejecting samples whose stride * height exceeds INT32_MAX.
Sandbox decoder processes so that a heap corruption crash does not impact the parent application or host.

bash

# Verify the installed libde265 version on Linux hosts
dpkg -l | grep libde265
rpm -q libde265
pkg-config --modversion libde265

# Rebuild from source against the patched release
git clone https://github.com/strukturag/libde265.git
cd libde265
git checkout v1.1.0
./autogen.sh && ./configure && make && sudo make install