CVE-2026-49337: CWE-770: Allocation of Resources Without Limits or Throttling in strukturag libde265
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.
AI Analysis
Technical Summary
The libde265 library, an open source implementation of the H.265 video codec, contains a resource allocation vulnerability (CWE-770) in versions before 1.0.20. Specifically, a crafted sequence of H.265 NAL units can cause the function decoder_context::read_slice_NAL() to attach slice headers to a finished picture object that lacks an active image unit. This leads to attacker-controlled unbounded heap growth as the retained slice headers are not freed until the picture is released, which may not happen during continuous streaming. This can cause a denial of service due to resource exhaustion. The vulnerability is addressed in libde265 version 1.0.20.
Potential Impact
An attacker can cause unbounded heap growth by sending specially crafted H.265 video streams, potentially leading to denial of service through resource exhaustion. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade libde265 to version 1.0.20 or later, where this issue is patched. No other mitigation is indicated.
CVE-2026-49337: CWE-770: Allocation of Resources Without Limits or Throttling in strukturag libde265
Description
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/strukturag/libde265Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The libde265 library, an open source implementation of the H.265 video codec, contains a resource allocation vulnerability (CWE-770) in versions before 1.0.20. Specifically, a crafted sequence of H.265 NAL units can cause the function decoder_context::read_slice_NAL() to attach slice headers to a finished picture object that lacks an active image unit. This leads to attacker-controlled unbounded heap growth as the retained slice headers are not freed until the picture is released, which may not happen during continuous streaming. This can cause a denial of service due to resource exhaustion. The vulnerability is addressed in libde265 version 1.0.20.
Potential Impact
An attacker can cause unbounded heap growth by sending specially crafted H.265 video streams, potentially leading to denial of service through resource exhaustion. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade libde265 to version 1.0.20 or later, where this issue is patched. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-29T14:35:45.902Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a35a6559187273676667ac9
Added to database: 06/19/2026, 20:28:05 UTC
Last enriched: 06/26/2026, 21:50:17 UTC
Last updated: 08/03/2026, 19:18:00 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.