# CVE-2026-49337: Strukturag libde265 unbounded heap growth in read_slice_NAL

Source: https://junglewise.ai/threats/cve-2026-49337-strukturag-libde265-unbounded-heap-growth-in-read-slice-nal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-49337 · Severity: medium · CVSS 4.3 · Published 2026-06-19

libde265 is an open-source library used to decode H.265 (HEVC) video streams. A vulnerability in how the library handles specific video data sequences allows an attacker to cause the application to consume an ever-increasing amount of system memory. This can lead to a denial-of-service (DoS) condition where the application or the entire system becomes unresponsive or crashes due to memory exhaustion, particularly during continuous video streaming.

Technologies: [struktur AG Libde265](https://junglewise.ai/threats/technologies/libde265). Vendors: [struktur AG](https://junglewise.ai/threats/vendors/struktur-ag).

## Quick answers

**Is CVE-2026-49337 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49337 being exploited in the wild.

**How severe is CVE-2026-49337?** Medium severity, with a CVSS score of 4.3, published 19 June 2026.

**Which products and versions are affected?** struktur AG Libde265 < 1.0.20.

**Is there a fix for CVE-2026-49337?** A patch was published on 2026-06-19: Version 1.0.20 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49337 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49337?** Check whether you run struktur AG Libde265 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in `decoder_context::read_slice_NAL()` within `libde265/decctx.cc`. When a crafted sequence of H.265 NAL units is processed, the decoder may attach slice headers to a finished picture object that no longer has an active image unit. Because these orphaned headers are only freed when the picture itself is released—which may not occur during continuous streaming—an attacker can trigger linear, unbounded heap growth. The root cause is that `decoder_context::img` continues to point at a finished picture after `decode_some()` drains an image unit, allowing subsequent non-first slice NALs to be accepted and appended to the picture's slice list indefinitely. This issue is resolved in version 1.0.20 by ensuring headers are not retained when no active image unit exists.

## Affected products

- strukturag libde265 < 1.0.20

## Timeline

- 2026-05-26: advisory: Original GitHub security advisory published
- 2026-06-19: disclosed: CVE-2026-49337 published to NVD
- 2026-06-19: patched: Version 1.0.20 released with fix

## References

- [https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9](https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9)
- [https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm](https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm)

## Related threats

- [Strukturag libde265 heap buffer overflow in decode_slice_unit_WPP](https://junglewise.ai/threats/cve-2026-45383-strukturag-libde265-heap-buffer-overflow-in-decode-slice-unit-wpp)
- [strukturag libde265 out-of-bounds read in decode_slice_unit_tiles](https://junglewise.ai/threats/cve-2026-45382-strukturag-libde265-out-of-bounds-read-in-decode-slice-unit-tiles)
- [Strukturag libde265 heap buffer overflow in de265_image_get_buffer](https://junglewise.ai/threats/cve-2026-49346-strukturag-libde265-heap-buffer-overflow-in-de265-image-get)
- [Strukturag libde265 out-of-bounds write in process_reference_picture_set](https://junglewise.ai/threats/cve-2026-49295-strukturag-libde265-out-of-bounds-write-in-process-reference)