libde265 CVE-2026-49346

Exploitation requires the target application to decode an attacker-supplied H.265 bitstream whose Sequence Parameter Set declares dimensions large enough that luma_height * luma_bpl (with BitDepth_Y or BitDepth_C of 16, i.e., 2 bytes per sample) exceeds INT32_MAX, triggering the 32-bit signed overflow in de265_image_get_buffer() at libde265/image.cc:128. The flaw lives in libde265 versions before 1.1.0 only and is reached through any caller that invokes de265_image_get_buffer()/fill_image() - typically libheif, browsers, image viewers, or media players. Per the CVSS vector (UI:R), user interaction is required: the victim must open, preview, or otherwise feed the malicious media to a libde265-backed decoder; no authentication is required (PR:N). Limiting factors include the need for the host process to actually allocate and survive a multi-gigabyte memcpy without earlier resource limits killing it, and any sandboxing or ASLR/heap hardening around the decoder.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H (7.1 High) accurately reflects a media-parsing flaw: network-reachable via any application that decodes attacker-supplied H.265 streams, but exploitation requires user interaction (opening a file, visiting a page, previewing a thumbnail) and yields high availability impact (process crash via OOB write of ~4 GB) with at most limited integrity impact in the abstract NVD model. In practice, an OOB heap write of attacker-controlled image data is a strong code-execution primitive on platforms without heavy heap hardening, so real-world impact may exceed C:N/I:L. No EPSS, KEV, or SSVC data was supplied; there is no public exploit identified at time of analysis and the issue is not on CISA KEV, suggesting risk is currently driven by exposure (how many downstream products embed libde265 and how quickly they rebuild) rather than known mass exploitation. Prioritization should be high for any product that ingests untrusted HEVC content (browsers, mail clients, file explorers with HEIC/HEIF thumbnailers).

An attacker crafts an H.265 bitstream whose SPS declares very large luma/chroma dimensions and 16-bit depth, then delivers it as an .hevc/.mp4/.heif/.heic file via email attachment, web page, messaging app, or shared folder. When the victim opens or previews the file, libde265's de265_image_get_buffer() allocates a ~1 KB plane buffer due to the 32-bit overflow, and fill_image() then writes the full multi-gigabyte plane content into that buffer, producing a heap overflow that crashes the decoder process and may be steered toward arbitrary code execution. No public proof-of-concept is referenced in the supplied data, but the patch commit precisely identifies the vulnerable arithmetic.