CVE-2026-49295

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue.

• CWE-787

• https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652bPatch
• https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594Exploit, Mitigation, Vendor Advisory
• https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594Exploit, Mitigation, Vendor Advisory

Published

Jun 19, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49288Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-4929Simple Hierarchical Select (SHS) for Drupal 7 contains cross…5.4
• CVE-2026-49290Slopsmith is a self-contained web application for browsing, …7.6
• CVE-2026-49291mcp-memory-service is a semantic memory layer for AI applica…8.1
• CVE-2026-49293js-toml is a TOML parser for JavaScript, fully compliant wit…7.5
• CVE-2026-49294Valhalla is an open source routing engine and accompanying l…6.1
• CVE-2026-49296Before apache-airflow 3.3.0, a user authorized to read one D…6.5
• CVE-2026-49297Apache Airflow's Google provider operators `GCSToSFTPOperato…8.1
• CVE-2026-49298A bug in Apache Airflow's KubernetesExecutor caused JWT toke…8.8
• CVE-2026-49299In OpenStack Neutron before 28.0.1, the tagging controller e…5.3
• CVE-2026-4930SYMCRYPTO is the SiXG301's host side hardware engine accesse…7.1
• CVE-2026-4931Smart contract Marginal v1 performs unsafe downcast, allowin…8.6