CVE-2026-3949
published 2026-07-21CVE-2026-3949: libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very…
PriorityP412low3.3CVSS 3.1
AVLACLPRLUINSUCNINAL
EPSS
0.13%
2.2th percentile
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libheif | — | — |
| struktur | libheif | < 1.22.0 | 1.22.0 |
| strukturag | libheif | < 1.22.0 | 1.22.0 |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P
osv4.8MEDIUM
vendor_debian4.8LOW
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libheif: libheif: Out-of-bounds read via local argument manipulation
vendor_redhat·2026-03-11·CVSS 4.8
CVE-2026-3949 [MEDIUM] CWE-805 libheif: libheif: Out-of-bounds read via local argument manipulation
libheif: libheif: Out-of-bounds read via local argument manipulation
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
A flaw was found in libheif. This vulnerability allows a local attacker to trigger an out-of-bounds read by manipulating the size argument in the `vvdec_push_data2` function. This could lead to a denial of service (DoS).
Statement: Thi
Debian
CVE-2026-3949: libheif - A vulnerability was determined in strukturag libheif up to 1.21.2. This affects ...
vendor_debian·2026·CVSS 4.8
CVE-2026-3949 [MEDIUM] CVE-2026-3949: libheif - A vulnerability was determined in strukturag libheif up to 1.21.2. This affects ...
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
CVE-2026-3949: A vulnerability was determined in strukturag libheif up to 1
osv·2026-03-11·CVSS 4.8
CVE-2026-3949 [MEDIUM] CVE-2026-3949: A vulnerability was determined in strukturag libheif up to 1
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
GHSA
GHSA-2rvx-jpm5-g848: A vulnerability was determined in strukturag libheif up to 1
ghsa_unreviewed·2026-03-11
CVE-2026-3949 [MEDIUM] CWE-119 GHSA-2rvx-jpm5-g848: A vulnerability was determined in strukturag libheif up to 1
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file [fedora-all]
bugzilla·2026-07-22·CVSS 3.3
CVE-2026-47251 [LOW] CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file [fedora-all]
CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge c
Bugzilla
CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file [epel-all]
bugzilla·2026-07-22·CVSS 3.3
CVE-2026-47251 [LOW] CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file [epel-all]
CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge cas
Bugzilla
CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file
bugzilla·2026-07-21·CVSS 3.3
CVE-2026-47251 [LOW] CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file
CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.
Bugzilla
CVE-2026-3949 libheif: libheif: Out-of-bounds read via local argument manipulation [epel-all]
bugzilla·2026-03-12·CVSS 3.3
CVE-2026-3949 [LOW] CVE-2026-3949 libheif: libheif: Out-of-bounds read via local argument manipulation [epel-all]
CVE-2026-3949 libheif: libheif: Out-of-bounds read via local argument manipulation [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
---
This bug is already fixed in a published Bodhi update: libheif-1.23.5-4.el10_3
Bugzilla
CVE-2026-3949 libheif: libheif: Out-of-bounds read via local argument manipulation [fedora-all]
bugzilla·2026-03-12·CVSS 3.3
CVE-2026-3949 [LOW] CVE-2026-3949 libheif: libheif: Out-of-bounds read via local argument manipulation [fedora-all]
CVE-2026-3949 libheif: libheif: Out-of-bounds read via local argument manipulation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-26ae66c60f (darktable-5.4.1-12.fc45, digikam-9.1.0-3.fc45, and 25 more) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-26ae66c60f
Wiz
CVE-2026-3949 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-3949 [MEDIUM] CVE-2026-3949 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3949 :
Linux Debian vulnerability analysis and mitigation
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
Source : NVD
## 4.8
Score
Published March 11, 2026
Severity MEDIUM
CNA Score 4.8
Affected Technologies
Linux Debian
Amazon Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date
2026-07-21
Published