What is the CVSS score of CVE-2026-49346?

CVE-2026-49346 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of libde265 are affected by CVE-2026-49346?

libde265 decoder library (versions prior to 1.1.0) is vulnerable to remote code execution through specially crafted H.265 videos, creating a direct pathway for system compromise in any application…. A patch is available.

How to fix or mitigate CVE-2026-49346?

Within 24 hours: identify all systems and applications using libde265 to establish risk scope within your environment. Within 7 days: implement mandatory video source validation controls, isolate H.265 video processing to restricted environments with minimal user privileges, and subscribe to vendor advisories for libde265 version 1.1.0+ release notifications. Within 30 days: upon vendor release of libde265 1.1.0 or later, immediately schedule testing in non-production environment, validate patch functionality, and deploy to production with appropriate change controls.

libde265 CVE-2026-49346

EUVD-2026-38080 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-19 GitHub_M

Buffer Overflow Integer Overflow Libde265 Strukturag

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

vuln.today AI

7.6 HIGH

Network-delivered media parsed with one user action, no auth, no special prerequisites; heap OOB write makes availability High and plausibly leaks/alters memory, so C and I set to Low.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 23:17 EUVD

Source Code Evidence Fetched

Jun 19, 2026 - 20:47 vuln.today

Analysis Generated

Jun 19, 2026 - 20:47 vuln.today

DescriptionCVE.org

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in de265_image_get_buffer() (libde265/image.cc:128). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent fill_image() call computes the real size using size_t, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

AnalysisAI

Heap buffer overflow in libde265 prior to version 1.1.0 allows remote attackers to corrupt heap memory and likely achieve code execution by tricking a user into processing a crafted H.265 video stream. The flaw stems from a 32-bit signed integer overflow in plane allocation sizing that wraps to ~1 KB, after which fill_image() writes the true ~4 GB plane content into the undersized buffer. No public exploit identified at time of analysis, but the upstream commit (8a1b5cf) and GHSA-vv8h-932h-7r86 publicly document the exact overflow location.

Technical ContextAI

libde265 (cpe:2.3:a:strukturag:libde265) is a widely embedded open-source HEVC/H.265 decoder used by image viewers, browsers, and media frameworks (e.g., libheif consumers). The root cause is CWE-190 (Integer Overflow or Wraparound): in libde265/image.cc, de265_image_get_buffer() computed plane sizes as int luma_height * luma_bpl using 32-bit signed arithmetic before passing the result to ALLOC_ALIGNED_16(). For SPS dimensions large enough combined with 16-bit bit depth (BitDepth_Y/C of 16, doubling bytes-per-line), the product exceeds INT32_MAX and wraps to a small positive value (~1 KB). The subsequent fill_image() path computes the same product in size_t, so it writes the genuine multi-gigabyte plane into the truncated allocation, producing a classic undersized-heap-buffer overflow. The patch (commit 8a1b5cf) promotes stride, height, and bytes-per-line to uint32_t and casts each multiplication to size_t before allocation and memcpy.

RemediationAI

Upgrade libde265 to vendor-released patch version 1.1.0, which fixes the integer overflow in de265_image_get_buffer() by widening stride/height to uint32_t and casting allocation and memcpy size computations to size_t (commit https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8; advisory https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86). Operators of distributions and applications that bundle libde265 should rebuild and ship 1.1.0 (or backport the patch) for libheif, image viewers, browsers, and HEIF thumbnailers. Where immediate upgrade is impossible, compensating controls include disabling HEIF/HEVC decoding in affected client applications, removing or disabling OS-level HEIC thumbnail handlers (trade-off: loss of HEIC preview), blocking HEVC/HEIF MIME types at mail and web gateways (trade-off: legitimate HEIC mail/web content is rejected), and enforcing sandboxing of decoder processes to contain the heap corruption.