7.1

CVE-2026-49295: struktur libde265 Out-of-bounds Write

CVSS: 7.1v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-49295DEBIAN-CVE-2026-49295
Published 19-06-2026Last modified 22-06-2026
Open JSON

Vulnerability summary

CVE-2026-49295 is a high (CVSS 7.1) Out-of-bounds Write vulnerability in struktur libde265. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
38/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
MGASA-2026-0420USN-8573-1

Timeline

  1. 19-06-2026
    PublishedVulnerability first disclosed.
  2. 22-06-2026
    Last modifiedVulnerability information updated.

Description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

26%

Versus all other CVEs

30-day change

0.00 pp

From 0.34% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Libde265

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • libde265< 1.0.11-1+deb12u3 | < 1.0.15-1+deb13u1 | < 1.1.1-1
Struktur1 product
Strukturag1 product
Ubuntu1 product
  • libde265< 1.0.2-2ubuntu0.16.04.1~esm6 | < 1.0.2-2ubuntu0.18.04.1~esm6 | < 1.0.4-1ubuntu0.4+esm2 | < 1.0.8-1ubuntu0.3+esm2 | < 1.0.15-1ubuntu0.1 | All versions (No fix recorded) | < 1.0.16-1ubuntu0.1~esm1

4 vendors · 4 products

References

6 links