libde265 suffers from a missing bound check on the construction of short‑term reference picture sets. A crafted H.265 bitstream can trigger an array write beyond the 16‑entry limit of the PocStFoll structure. This out‑of‑bounds write can corrupt memory, potentially causing a crash or enabling arbitrary code execution if exploited maliciously. The flaw is classified as CWE‑787, which denotes out‑of‑bounds write vulnerabilities.

The issue exists in the structure decoder_context::process_reference_picture_set() in libde265. Versions prior to 1.0.20 are affected. The library is maintained by strukturag and is used in various open‑source video decoding projects. Users relying on any version older than 1.0.20 and decoding untrusted H.265 streams are affected.

The CVSS v3.1 score of 7.1 indicates moderate to high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploitation in the wild at this time. The likely attack vector is an application that processes externally supplied H.265 bitstreams, potentially over the network or from local files. If the application bypasses normal security boundaries, an attacker could deliver the crafted stream to trigger the memory corruption.