CVE-2026-49295

What it actually does

CVE-2026-49295 is an out-of-bounds array write in libde265 before version 1.0.20, an open-source H.265/HEVC video decoding library. A malformed H.265 bitstream can trigger incorrect construction of predicted short-term reference picture set entries in `decoder_context::process_reference_picture_set()`. Although individual reference-picture-list sizes are checked, the aggregate count can exceed the fixed 16-entry `PocStFoll` array, causing a write at index 16. The most likely outcomes are decoder crash, memory corruption, and denial of service; depending on compiler, allocator, platform hardening, and embedding application behavior, limited data corruption or more severe memory-safety impact may be possible.

Why it matters to the business

Applications, media pipelines, content-scanning services, browsers, image/video previewers, messaging platforms, and backend processing jobs that decode untrusted H.265 content with vulnerable libde265 versions can be crashed by a specially crafted video file or stream. Operational impact may include service instability, failed media ingestion, worker crashes, user-facing preview failures, or disruption of automated content-processing workflows. The issue is not currently listed in CISA KEV, is not known to be used in ransomware, and has low EPSS at the time of assessment, but exposure is still meaningful where untrusted media is processed at scale or automatically.

How an attack unfolds

An attacker creates an H.265/HEVC bitstream with reference picture set metadata designed to pass the individual list-size checks while causing the combined predicted short-term reference picture set count to exceed the internal 16-entry `PocStFoll` array. The attacker then delivers the file or stream to a target path that invokes libde265 decoding, such as upload, preview, transcoding, thumbnail generation, malware scanning, or media playback. When the vulnerable decoder processes the crafted bitstream, `decoder_context::process_reference_picture_set()` writes past the end of the array. In typical deployments this results in a decoder or worker-process crash; in less common circumstances, memory corruption may affect adjacent state and alter process behavior. Exploitation requires user interaction or an automated system that processes attacker-supplied media, but does not require authentication if the affected service accepts public uploads or remote media.

How to fix it

Upgrade libde265 to version 1.0.20 or later wherever it is used directly or bundled into applications, containers, media-processing services, desktop software, or third-party packages. If vendor packages do not yet expose an explicit fixed build, track the upstream fix and apply the relevant distribution or application update as soon as available. Rebuild dependent software against the fixed library and verify runtime linkage does not continue to load an older shared object. As interim mitigations, disable or restrict H.265/HEVC processing from untrusted sources, isolate media decoding in sandboxed worker processes, enforce upload size and type restrictions, process media with timeouts and crash containment, and route untrusted media through patched transcoding or scanning components only.

How to confirm the fix worked

Confirm that all deployed libde265 instances report version 1.0.20 or later, including copies embedded in applications, container images, desktop packages, and statically linked binaries. On Linux systems, inspect package manager inventory, shared library paths, and application dependency output such as `ldd` to ensure vulnerable `libde265` libraries are not loaded at runtime. Rebuild and redeploy applications that vendor or statically link libde265. Where safe and authorized, use a regression test or vendor-provided test corpus to confirm crafted H.265 streams no longer crash the decoder. Review media-processing services after upgrade to verify that H.265 uploads, previews, and transcodes continue to work normally without worker crashes.

Typical attack path

1. Identify an application or service that decodes H.265/HEVC media using libde265 before version 1.0.20.
2. Craft an H.265 bitstream with predicted short-term reference picture set entries whose aggregate count exceeds the 16-entry internal array while passing individual validation checks.
3. Deliver the crafted video through an upload, message attachment, embedded media link, stream, preview, or content-processing workflow.
4. Trigger decoding by the vulnerable application, media worker, thumbnailer, scanner, or playback component.
5. Cause an out-of-bounds write during `decoder_context::process_reference_picture_set()`, typically resulting in process crash or denial of service.
6. Optionally repeat delivery to cause sustained service instability where processing is automatic or retry-based.

How to detect it

Look for evidence of crashes or abnormal termination in applications that decode H.265/HEVC content using libde265. Relevant sources include application logs for media upload, preview, thumbnail, transcoding, and scanning services; Linux syslog or journald; container runtime logs; crash dump directories; core dump handlers such as systemd-coredump, apport, or ABRT; EDR process telemetry; web access logs for recent media uploads; and queue/job logs showing repeated failures on the same media object. Focus on segmentation faults, aborts, ASAN findings, or worker restarts occurring immediately after processing `.hevc`, `.h265`, `.265`, `.mkv`, `.mp4`, or other HEVC-containing files. Correlate crashes with source IPs, user agents, upload events, message attachments, or media-ingestion jobs. If crash dumps are available, inspect stack traces for `decoder_context::process_reference_picture_set`, `libde265/decctx.cc`, or libde265 frames. There are no public threat actors or ransomware campaigns currently associated with this CVE, so detection should emphasize behavioral evidence of malformed-media processing rather than actor-specific infrastructure.

• decoder_context::process_reference_picture_set
• libde265/decctx.cc:1376
• PocStFoll
• libde265
• SIGSEGV
• segmentation fault
• AddressSanitizer: heap-buffer-overflow
• AddressSanitizer: stack-buffer-overflow
• out-of-bounds
• process_reference_picture_set
• .h265
• .hevc
• .265

What your security team should do

• Inventory all systems, applications, containers, and media-processing workflows that include or link against libde265, especially internet-facing upload, preview, transcoding, and content-scanning paths.
• Prioritize upgrading libde265 to version 1.0.20 or later in services that automatically process untrusted H.265/HEVC content.
• Ask application and appliance vendors whether their products bundle libde265 and whether their fixed releases include the upstream 1.0.20 patch.
• Temporarily restrict H.265/HEVC uploads or route them to isolated, sandboxed, resource-limited processing workers until patching is complete.
• Monitor for repeated decoder, thumbnailer, transcoder, or media-worker crashes associated with newly received H.265/HEVC files.
• Add fuzzing or malformed-media regression tests to media-processing CI pipelines where libde265 is used in custom software.
• Because the CVE is not currently KEV-listed and has low EPSS, handle through normal vulnerability remediation timelines unless the organization processes high volumes of untrusted media, in which case treat as higher priority.