CVE-2026-49295

{
  "id": "CVE-2026-49295",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-19T21:17:01.590",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue."
    },
    {
      "lang": "es",
      "value": "libde265 es una implementación de código abierto del códec de video h.265. Antes de la versión 1.0.20, un flujo de bits H.265 manipulado puede causar una escritura fuera de límites de un array en ’decoder_context::process_reference_picture_set()’ (’libde265/decctx.cc:1376’). La causa raíz es una falta de comprobación de límites agregada en las entradas del conjunto de imágenes de referencia a corto plazo predichas. Los tamaños de las listas individuales se validan, pero el recuento combinado después de la construcción del RPS predicho puede exceder el array ’PocStFoll’ de 16 entradas, escribiendo en el índice 16. La versión 1.0.20 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "strukturag",
          "product": "libde265",
          "versions": [
            {
              "version": "< 1.0.20",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-22T17:18:41.430511Z",
          "id": "CVE-2026-49295",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.0.20",
              "matchCriteriaId": "DFAFB5DC-69ED-439B-8046-9F12CA49D5AE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}