CVE-2026-49346: libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in de265imagegetbuffer() (libde265/image.cc:128). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent fillimage() call computes the real size using sizet, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libde265to a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49346?
CVE-2026-49346 has a severity rating of high, with a score of 7.1.
How do I fix CVE-2026-49346?
To fix CVE-2026-49346, upgrade to version 1.1.0 or later of libde265.
What causes the vulnerability in CVE-2026-49346?
CVE-2026-49346 is caused by a heap buffer overflow due to a signed integer overflow in the de265_image_get_buffer function.
What impact can CVE-2026-49346 have on my system?
CVE-2026-49346 can lead to a denial of service due to potential crashes of the libde265 library.
Is CVE-2026-49346 an open-source vulnerability?
Yes, CVE-2026-49346 affects the open source libde265 library used for H.265 video decoding.