Executive brief
libde265 is an open-source library used to decode H.265 (HEVC) video streams. A vulnerability in how the library handles specific video data sequences allows an attacker to cause the application to consume an ever-increasing amount of system memory. This can lead to a denial-of-service (DoS) condition where the application or the entire system becomes unresponsive or crashes due to memory exhaustion, particularly during continuous video streaming.
Technical details
A vulnerability exists in `decoder_context::read_slice_NAL()` within `libde265/decctx.cc`. When a crafted sequence of H.265 NAL units is processed, the decoder may attach slice headers to a finished picture object that no longer has an active image unit. Because these orphaned headers are only freed when the picture itself is released—which may not occur during continuous streaming—an attacker can trigger linear, unbounded heap growth. The root cause is that `decoder_context::img` continues to point at a finished picture after `decode_some()` drains an image unit, allowing subsequent non-first slice NALs to be accepted and appended to the picture's slice list indefinitely. This issue is resolved in version 1.0.20 by ensuring headers are not retained when no active image unit exists.
Affected products
- strukturag libde265 < 1.0.20
Timeline
- 2026-05-26: advisory: Original GitHub security advisory published
- 2026-06-19: disclosed: CVE-2026-49337 published to NVD
- 2026-06-19: patched: Version 1.0.20 released with fix