The vulnerability in libde265 (CVE-2026-49346) is an integer overflow (CWE-190) in the de265_image_get_buffer() function. When processing a specially crafted H.265 bitstream with large sequence parameter set (SPS) dimensions and 16-bit bit depth, a signed integer overflow occurs during plane allocation size calculation, wrapping the size to a small value (~1 KB). However, the fill_image() function uses a size_t type to compute the actual required size and writes about 4 GB of data into the undersized heap buffer, causing a heap buffer overflow. This can lead to denial of service or potential memory corruption. The issue is fixed in libde265 version 1.1.0.

The integer overflow leads to a heap buffer overflow by writing significantly more data than allocated, which can cause application crashes or memory corruption. The CVSS 3.1 base score is 7.1 (high severity), indicating a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. There are no known exploits in the wild at this time.

Upgrade libde265 to version 1.1.0 or later, where this vulnerability is patched. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the version fix; users should verify with the vendor advisory or official release notes to ensure the fix is applied.