Out-of-Bounds Write Vulnerability in libde265 H.265 Video Codec

CVE-2026-49295

What is CVE-2026-49295?

The libde265 library, an open-source implementation of the H.265 video codec, is susceptible to an out-of-bounds write vulnerability due to a missing validation check in the processing of reference picture sets. Specifically, when handling crafted H.265 bitstreams, the library can write beyond its allocated array bounds, leading to potential crashes or arbitrary code execution. This issue arises from inadequate checks on the combined count of predicted short-term reference picture set entries, allowing writes to indices that exceed the array limit. The vulnerability is resolved in version 1.0.20, where appropriate aggregate bound checks have been implemented.

References