CVE-2026-49337: libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`
Last updated 17 July 2026
Other sources
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes decodercontext::readsliceNAL() (libde265/decctx.cc:481) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libde265to a version that resolves this vulnerability.Fixed in 1.1.1-1 - Upgrade
Upgrade
libde265to a version that resolves this vulnerability.Fixed in 1.0.20
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49337?
The severity of CVE-2026-49337 is medium with a score of 4.3.
How do I fix CVE-2026-49337?
To mitigate CVE-2026-49337, upgrade libde265 to version 1.0.20 or later.
What type of vulnerability is CVE-2026-49337?
CVE-2026-49337 is an unbounded memory leak vulnerability in the libde265 library.
What components are affected by CVE-2026-49337?
CVE-2026-49337 affects the read_slice_NAL function in the libde265 library's decoding context.
What is the potential impact of CVE-2026-49337?
The impact of CVE-2026-49337 includes excessive memory consumption leading to denial of service.