CVE-2026-49337

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49337", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-29T14:35:45.902Z", "datePublished": "2026-06-19T19:53:18.817Z", "dateUpdated": "2026-06-22T14:00:14.667Z"}, "containers": {"cna": {"title": "libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm"}, {"name": "https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9", "tags": ["x_refsource_MISC"], "url": "https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9"}], "affected": [{"vendor": "strukturag", "product": "libde265", "versions": [{"version": "< 1.0.20", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T20:10:36.194Z"}, "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object\nthat has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue."}], "source": {"advisory": "GHSA-g5hj-rf9f-7vxm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T13:59:34.760551Z", "id": "CVE-2026-49337", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T14:00:14.667Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49337", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T13:59:34.760551Z"}}}], "references": [{"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T14:00:05.818Z"}}], "cna": {"title": "libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`", "source": {"advisory": "GHSA-g5hj-rf9f-7vxm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "strukturag", "product": "libde265", "versions": [{"status": "affected", "version": "< 1.0.20"}]}], "references": [{"url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm", "name": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9", "name": "https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object\nthat has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T20:10:36.194Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49337", "state": "PUBLISHED", "dateUpdated": "2026-06-22T14:00:14.667Z", "dateReserved": "2026-05-29T14:35:45.902Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-19T19:53:18.817Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libde265", "vendor": "strukturag", "versions": [{"status": "affected", "version": "< 1.0.20"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object\nthat has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue."}, {"lang": "es", "value": "libde265 es una implementaci\u00f3n de c\u00f3digo abierto del c\u00f3dec de video h.265. Antes de la versi\u00f3n 1.0.20, una secuencia manipulada de unidades NAL de H.265 provoca que decoder_context::read_slice_NAL() (libde265/decctx.cc:481) adjunte encabezados de segmento a un objeto de imagen finalizado que no tiene una unidad de imagen activa, lo que resulta en un crecimiento de pila ilimitado controlado por el atacante. Los encabezados retenidos nunca se liberan hasta que se libera la imagen, lo cual puede no ocurrir durante la transmisi\u00f3n continua. La versi\u00f3n 1.0.20 corrige el problema."}], "id": "CVE-2026-49337", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49337", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T13:59:34.760551Z", "version": "2.0.3"}}]}, "published": "2026-06-19T21:17:01.720", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9"}, {"source": "security-advisories@github.com", "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.20)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "libde265", "source": "cna", "vendor": "strukturag"}, "product": "libde265", "vendor": "struktur"}], "created": "2026-06-19T21:30:17.792480+00:00", "updated": "2026-06-24T20:30:04.362825+00:00", "vendors": ["struktur", "struktur$PRODUCT$libde265"]}