{"id":"CVE-2026-49346","summary":"libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow","details":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.","aliases":["GHSA-vv8h-932h-7r86"],"modified":"2026-08-12T16:25:35.020330Z","published":"2026-06-19T20:12:14.958Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49346.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49346.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49346"},{"type":"FIX","url":"https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libde265","events":[{"introduced":"0"},{"fixed":"f0e5137ee10af674dcb5ac8ed5d02f5a102225af"},{"fixed":"8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8"}],"database_specific":{"cpe":"cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.1.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.0","v0.5","v0.4","v0.3","v0.2","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49346.json","vanir_signatures_modified":"2026-08-12T16:25:35Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8","target":{"file":"libde265/image.cc","function":"de265_alloc_image_plane"},"deprecated":false,"digest":{"function_hash":"147176829153161336648682223151634823940","length":677},"id":"CVE-2026-49346-181472e3"},{"deprecated":false,"digest":{"function_hash":"220896103505704885453970870779977515427","length":1581},"id":"CVE-2026-49346-6d561673","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8","target":{"file":"libde265/image.cc","function":"de265_image_get_buffer"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8","target":{"file":"libde265/image.cc"},"deprecated":false,"digest":{"line_hashes":["40419494937393674600294107144927266072","156922661229603807886362443071351210804","53503243586850819582866350272843652762","105849735730209843405452299646372436586","158579856250421710788452350270053597028","243112116629678069343442656435259157306","294921012078188619465331146337799045125","139334386095805604088308753228045074448","180357919016290568130507640005188000509","301556938540835024047261927703593202767","323580550810438177819009151310801803875","64328521247580353150500489569973783054","163275754284412294267553892602476623757","164694675671664028336554888511015544110","217251924201609092691121625159051031235","327970011921408291146651594903797011742","245197746329202587358259280937636139543","60778642710236278279347018951182445199","98027627046479612848427176905018154381","148097323458834907932890877352048530562","127049026898825232322328712116143549969","177487694103956539831751194884368909507","337461779018106887904005291466090703883","83696827308546504434313158755080953390","259577027533737059637700871489159236989","224358653257448369354798708894963474510","26005099948866771816010327762246081459","166067409949975448517827824503160891504","86852089727427477278448765554073481495","302451293703990359034678349436840464347","46103688717465483198793551169325083650","178483228682233669256174747459907360462","237026597237789952175212522401952620260","157641268384319132093917912546086177873","125239476170766842250291007635806972169"],"threshold":0.9},"id":"CVE-2026-49346-d50716d3"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"}]}