libde265 CVE-2026-49337

Exploitation requires that the target application invoke decoder_context::read_slice_NAL() on an attacker-supplied H.265 bitstream containing a sequence of non-first-slice NAL units directed at a picture object in a finished state (no active image unit). The CVSS PR:N confirms no authentication or privilege is required to supply the malicious bitstream. The CVSS UI:R metric reflects that a user or automated process must initiate decoding of the crafted content - passive network presence is insufficient. Impact severity scales with streaming duration: short, bounded decode sessions accumulate fewer orphaned headers and may not reach observable memory pressure, while continuous or long-lived streaming contexts are the realistic high-risk scenario. Exploitation is bounded to the libde265 decoding process (S:U); no lateral movement or privilege escalation primitive is present. Versions 1.0.20 and later are not affected.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) accurately reflects a moderate-severity availability-only flaw. The UI:R metric is the principal risk-limiting factor in isolation, but for media servers, transcoding pipelines, and applications that automatically fetch and decode user-supplied streams, the 'user interaction' is effectively automated, collapsing the practical barrier. No EPSS score is present in the provided intelligence, so exploitation probability cannot be quantified numerically. The absence of a CISA KEV listing and the absence of any confirmed public POC together indicate no widespread opportunistic exploitation at time of analysis. The CWE-770 class (unbounded resource allocation) produces a gradual memory exhaustion rather than an immediate crash or code execution primitive, which may allow some defensive headroom (process memory limits, watchdog restart) but does not eliminate risk in resource-constrained or high-uptime services. Real-world priority should be elevated for deployments consuming untrusted H.265 input (media servers, video-on-demand platforms, browser plugin contexts) and lower for air-gapped or internally-sourced media workflows.

An attacker crafts an H.265 video file containing a sustained sequence of non-first-slice NAL units targeting a finished picture object, then delivers it to a media server or streaming application via a user-controlled upload, a malicious media URL, or an auto-playing embed. Each malformed NAL unit causes a slice header to be allocated and appended to the picture's internal list without ever being freed, progressively exhausting available heap memory. Given sufficient streaming duration or repetition, the target process is terminated by the operating system's OOM killer, resulting in denial of service; no confirmed public POC exists at time of analysis.