CVE-2026-49346 libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow

High 7.1 Published 19 Jun 2026 Updated 22 Jun 2026

A crafted H.265 bitstream triggers an integer overflow leading to a heap buffer overflow, allowing attackers to execute arbitrary code or crash the application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-49346?

CVE-2026-49346 is a high-severity vulnerability in Struktur Libde265, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

Weakness: CWE-190

Which versions are affected by CVE-2026-49346?

It affects 1 product.

Products include Struktur Libde265.

How do I fix CVE-2026-49346?

Upgrade to a fixed version.

Is CVE-2026-49346 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49346 exists.

All Struktur Libde265 vulnerabilities

Sources

Also known as ALPINE-CVE-2026-49346, BELL-CVE-2026-49346, DEBIAN-CVE-2026-49346, ECHO-7756-d9d5-6fc4, GHSA-vv8h-932h-7r86, JLSEC-2026-790 and 3 more.