CVE-2026-49295

Name of the Vulnerable Software and Affected Versions libde265 versions prior to 1.0.20

Description An out-of-bounds array write exists in the h.265 video codec implementation. A crafted H.265 bitstream can trigger this issue within the decoder context::process reference picture set() function. The problem stems from a missing aggregate bound check on predicted short-term reference picture set entries; while individual list sizes are validated, the combined count after construction can exceed the 16-entry PocStFoll array, resulting in a write at index 16. This memory corruption could potentially allow an attacker to execute arbitrary code.

Recommendations Update to version 1.0.20.