What is the CVSS score of CVE-2026-49295?

CVE-2026-49295 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of libde265 are affected by CVE-2026-49295?

libde265, a widely-deployed HEVC video decoding library, contains a memory corruption vulnerability (CVSS 7.1) that could enable remote code execution when users process maliciously crafted video…. A patch is available.

How to fix or mitigate CVE-2026-49295?

Within 24 hours: Identify all systems using libde265 (check video applications, media servers, and codec library dependencies for versions prior to 1.0.20). Within 7 days: Contact libde265 upstream maintainers and dependent software vendors for patch availability; implement interim mitigations immediately. Within 30 days: Deploy libde265 version 1.0.20 or later across all affected systems; test with production video workloads.

libde265 CVE-2026-49295

EUVD-2026-38079 HIGH

Out-of-bounds Write (CWE-787)

2026-06-19 GitHub_M

Buffer Overflow Memory Corruption Libde265 Strukturag

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Network-delivered crafted bitstream, no auth, but requires the user to open the file (UI:R); OOB write yields integrity tampering and high availability impact with no direct confidentiality disclosure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 23:17 EUVD

Source Code Evidence Fetched

Jun 19, 2026 - 20:45 vuln.today

Analysis Generated

Jun 19, 2026 - 20:45 vuln.today

DescriptionCVE.org

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in decoder_context::process_reference_picture_set() (libde265/decctx.cc:1376). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry PocStFoll array, writing at index 16. Version 1.0.20 patches the issue.

AnalysisAI

Out-of-bounds write in libde265 prior to version 1.0.20 allows remote attackers to corrupt memory by tricking a user into processing a maliciously crafted H.265 bitstream. The flaw resides in the short-term reference picture set handling and can lead to denial of service or potential code execution in any application that links libde265 for HEVC decoding. No public exploit identified at time of analysis, though the upstream patch and commit-level root-cause disclosure provide a clear roadmap for exploit development.

Technical ContextAI

libde265 (cpe:2.3:a:strukturag:libde265) is a widely embedded open-source HEVC/H.265 video decoder used by media players, browsers, and image libraries such as libheif. The vulnerability is a classic CWE-787 out-of-bounds write triggered in decoder_context::process_reference_picture_set() at libde265/decctx.cc:1376. Per the upstream commit (691f3a3c), individual short-term reference picture lists are bounded, but the predicted-RPS construction appends the current-picture delta to an already-full source set, allowing the aggregate NumDeltaPocs to exceed MAX_NUM_REF_PICS (16). The decoder then writes at index 16 of the fixed-size PocStFoll array, corrupting adjacent memory in the decoder context structure.

RemediationAI

Vendor-released patch: libde265 1.0.20 - upgrade to this version, which adds an aggregate NumDeltaPocs > MAX_NUM_REF_PICS check in read_short_term_ref_pic_set() (commit 691f3a3c55b3d32478c4a49895dee061a282652b). Downstream packagers should rebuild dependents (libheif, GStreamer plugins, media apps) against the patched library and redistribute. If immediate upgrade is not feasible, compensating controls include blocking or sandboxing the rendering of untrusted HEVC/.heic/.h265 content at the email gateway and web proxy, running media-processing services under seccomp/AppArmor profiles that restrict syscalls, and disabling HEVC support in browsers or thumbnailers where it is not business-critical - with the trade-off of breaking legitimate HEVC playback for users. Reference the GHSA advisory at https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594.