CVE-2026-3949

A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdecpushdata2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.

Database specific

{
    "cwe_ids": [
        "CWE-119",
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3949.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/strukturag/libheif

Affected ranges

Type

GIT

Repo

https://github.com/strukturag/libheif

Events

Introduced

81b09baa38ac8654d34d0f8b7780c44addfc7893

Fixed

b97c8b5f198b27f375127cd597a35f2113544d03

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.21.0"
        },
        {
            "last_affected": "1.21.0"
        },
        {
            "introduced": "1.21.1"
        },
        {
            "last_affected": "1.21.1"
        },
        {
            "introduced": "1.21.2"
        },
        {
            "last_affected": "1.21.2"
        }
    ]
}

Affected versions

1.*

1.21.0

1.21.1

1.21.2

v1.*

v1.21.0

v1.21.1

v1.21.2

Database specific

vanir_signatures_modified

"2026-07-15T23:37:17Z"

vanir_signatures

[
    {
        "signature_type": "Line",
        "target": {
            "file": "libheif/plugins/decoder_vvdec.cc"
        },
        "deprecated": false,
        "source": "https://github.com/strukturag/libheif/commit/b97c8b5f198b27f375127cd597a35f2113544d03",
        "id": "CVE-2026-3949-35acf889",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "241394016192530154728775493219794092134",
                "306070744995062561529607612816830400187",
                "222263289327577883699071857898995442826",
                "95113494202903003317628323001320890145",
                "306095758132309700395813887161949265853",
                "330046478980160121851119960901217415066",
                "291482973947041319417118209145053084229",
                "93434688375480901107547632780894131127"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "libheif/plugins/decoder_vvdec.cc",
            "function": "vvdec_push_data2"
        },
        "deprecated": false,
        "source": "https://github.com/strukturag/libheif/commit/b97c8b5f198b27f375127cd597a35f2113544d03",
        "id": "CVE-2026-3949-a4f33640",
        "signature_version": "v1",
        "digest": {
            "function_hash": "125050619902725537773320484018886304502",
            "length": 549.0
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3949.json"