Is CVE-2026-49346 actively exploited?

No active exploitation of CVE-2026-49346 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49346 be exploited remotely?

Yes. CVE-2026-49346 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-49346?

CVE-2026-49346 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2026-49346

HIGH

CVE-2026-49346

CWE-190Published: June 19, 2026· Updated: Jun 26, 2026

7.1

CVSS v3.1

Official Description

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue.

NVD Source

Technical Analysis

CVE-2026-49346 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.1.