new file mode 100644
@@ -0,0 +1,53 @@
+From 2f0c53241cb9bf2f5acded53c25f1b74db536de7 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Mon, 25 May 2026 20:29:40 +0200
+Subject: [PATCH] free orphaned slice header when no active image unit
+ (GHSA-g5hj-rf9f-7vxm)
+
+(cherry picked from commit 683cb9fa603e35840642f98765ab95cdb71cadf9)
+
+CVE: CVE-2026-49337
+Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libde265/decctx.cc | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/libde265/decctx.cc b/libde265/decctx.cc
+index fbb3baa1..5deddc37 100644
+--- a/libde265/decctx.cc
++++ b/libde265/decctx.cc
+@@ -478,10 +478,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+ shdr->entry_point_offset[i] -= skipped;
+ }
+
+- this->img->add_slice_segment_header(shdr);
+-
+-
+-
+ // --- start a new image if this is the first slice ---
+
+ if (shdr->first_slice_segment_in_pic_flag) {
+@@ -495,6 +491,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+
+ if ( ! image_units.empty() ) {
+
++ // Hand the slice header to the picture (which takes ownership and frees it
++ // on release). Only do this when there is an active image unit to decode
++ // the slice; otherwise the header would be retained on img->slices forever,
++ // which a crafted stream of non-first slice NALs can exploit to grow memory
++ // without bound.
++ this->img->add_slice_segment_header(shdr);
++
+ slice_unit* sliceunit = new slice_unit(this);
+ sliceunit->nal = nal;
+ sliceunit->shdr = shdr;
+@@ -507,6 +510,7 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+ }
+ else {
+ nal_parser.free_NAL_unit(nal);
++ delete shdr;
+ }
+
+ bool did_work;
@@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f"
SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \
file://CVE-2026-49295.patch \
+ file://CVE-2026-49337.patch \
"
SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"