CVE-2026-49295

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49295", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-28T20:07:58.862Z", "datePublished": "2026-06-19T20:09:22.555Z", "dateUpdated": "2026-06-22T17:18:46.213Z"}, "containers": {"cna": {"title": "libde265 has an out-of-bounds write in process_reference_picture_set via predicted short-term RPS", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594"}, {"name": "https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b", "tags": ["x_refsource_MISC"], "url": "https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b"}], "affected": [{"vendor": "strukturag", "product": "libde265", "versions": [{"version": "< 1.0.20", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T20:12:41.334Z"}, "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue."}], "source": {"advisory": "GHSA-g2rg-wj66-w594", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T17:18:41.430511Z", "id": "CVE-2026-49295", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T17:18:46.213Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T17:18:41.430511Z"}}}], "references": [{"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T17:18:33.102Z"}}], "cna": {"title": "libde265 has an out-of-bounds write in process_reference_picture_set via predicted short-term RPS", "source": {"advisory": "GHSA-g2rg-wj66-w594", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "strukturag", "product": "libde265", "versions": [{"status": "affected", "version": "< 1.0.20"}]}], "references": [{"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594", "name": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b", "name": "https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T20:12:41.334Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49295", "state": "PUBLISHED", "dateUpdated": "2026-06-22T17:18:46.213Z", "dateReserved": "2026-05-28T20:07:58.862Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-19T20:09:22.555Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libde265", "vendor": "strukturag", "versions": [{"status": "affected", "version": "< 1.0.20"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:struktur:libde265:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFAFB5DC-69ED-439B-8046-9F12CA49D5AE", "versionEndExcluding": "1.0.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue."}, {"lang": "es", "value": "libde265 es una implementaci\u00f3n de c\u00f3digo abierto del c\u00f3dec de video h.265. Antes de la versi\u00f3n 1.0.20, un flujo de bits H.265 manipulado puede causar una escritura fuera de l\u00edmites de un array en \u2019decoder_context::process_reference_picture_set()\u2019 (\u2019libde265/decctx.cc:1376\u2019). La causa ra\u00edz es una falta de comprobaci\u00f3n de l\u00edmites agregada en las entradas del conjunto de im\u00e1genes de referencia a corto plazo predichas. Los tama\u00f1os de las listas individuales se validan, pero el recuento combinado despu\u00e9s de la construcci\u00f3n del RPS predicho puede exceder el array \u2019PocStFoll\u2019 de 16 entradas, escribiendo en el \u00edndice 16. La versi\u00f3n 1.0.20 corrige el problema."}], "id": "CVE-2026-49295", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49295", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T17:18:41.430511Z", "version": "2.0.3"}}]}, "published": "2026-06-19T21:17:01.590", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.20)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "libde265", "source": "cna", "vendor": "strukturag"}, "product": "libde265", "vendor": "struktur"}], "created": "2026-06-19T21:30:17.792246+00:00", "updated": "2026-06-24T20:30:04.362404+00:00", "vendors": ["struktur", "struktur$PRODUCT$libde265"]}