CVE-2026-49337 libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes decodercontext::readsliceNAL libde265/decctx.cc:481 to attach slice headers to a finished picture object that has no active image unit, resulting in...

CVE-2026-49337

CVE-2026-49337 affects libde265 prior to 1.0.20. A crafted sequence of H.265 NAL units lets decoder_context::read_slice_NAL() attach slice headers to a finished picture object with no active image unit, causing attacker-controlled unbounded heap growth. The headers are retained until the picture ...

CVE-2026-49337 libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes decodercontext::readsliceNAL libde265/decctx.cc:481 to attach slice headers to a finished picture object that has no active image unit, resulting in...

CVE-2026-49337

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes decodercontext::readsliceNAL libde265/decctx.cc:481 to attach slice headers to a finished picture object that has no active image unit, resulting in...

PT-2026-51027

Name of the Vulnerable Software and Affected Versions libde265 versions prior to 1.0.20 Description An issue in the h.265 video codec implementation allows a crafted sequence of H.265 NAL units to cause the decoder context::read slice NAL function to attach slice headers to a finished picture...

PT-2026-51028

Name of the Vulnerable Software and Affected Versions libde265 versions prior to 1.1.0 Description An open source implementation of the h.265 video codec contains a signed integer overflow in the de265 image get buffer function. This occurs when processing a crafted H.265 bitstream with 16-bit bi...

PT-2026-51026

Name of the Vulnerable Software and Affected Versions libde265 versions prior to 1.0.20 Description An open source implementation of the h.265 video codec contains an issue where a crafted H.265 bitstream can trigger an out-of-bounds array write within the decoder context::process reference pictu...

Astra Linux – Vulnerability in libde265

It was discovered that libde265 v1.0.10 contains a NULL pointer dereference in the putunweightedpred16fallback function located in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack through a crafted input file...

Astra Linux – Vulnerability in libde265

It was discovered that libde265 v1.0.10 contains a NULL pointer dereference in the putweightedpred8fallback function located in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack through a crafted input file...

Astra Linux – Vulnerability in libde265

It was discovered that libde265 v1.0.10 contains a NULL pointer dereferencing in the ffhevcputunweightedpred8sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack through a crafted input file...

Astra Linux – Vulnerability in libde265

Libde265 v1.0.4 contains a heap buffer overflow in the ffhevcputunweightedpred8sse function, which can be exploited through a specially crafted file...

Astra Linux – Vulnerability in libde265

libde265 v1.0.4 contains a heap buffer overflow vulnerability in the mmloadlepi64 function, which can be exploited through a specially crafted file...

Astra Linux – Vulnerability in libde265

A buffer overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code through the SAO Sample Adaptive Offset processing of libde265...

Astra Linux – Vulnerability in libde265

Libde265 v1.0.4 contains a heap buffer overflow vulnerability in the putepel16fallback function, which can be exploited through a specially crafted file...

Astra Linux – Vulnerability in libde265

A issue has been found in libde265 v1.0.8 due to incorrect access control. A segmentation fault has occurred as a result of a READ memory access in the deriveboundaryStrength function of deblock.cc. This vulnerability causes a segmentation fault and results in the crash of the application, leadin...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a segmentation violation due to the use of applysaointernal in sao.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack through a crafted video file...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains an unknown vulnerability through the ffhevcputhevcqpelv38sse function in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a specially crafted video file...

Astra Linux – Vulnerability in libde265

Libde265 v1.0.4 contains a heap buffer overflow in the de265image::availablezscan function, which can be exploited through a specially crafted file...

Astra Linux – Vulnerability in libde265

A issue was discovered in libde265 v1.0.8. There is a heap-use-after-free issue in intrapred.h when decoding files using dec265...

Astra Linux – Vulnerability in libde265

It was discovered that libde265 v1.0.10 contains a NULL pointer dereferencing issue in the mcchroma function at motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack through a crafted input file...