VDB
DEBIAN-CVE-2026-3949
DEBIAN-CVE-2026-3949
PUBLISHED
CVSS 3.299999952316284 LOW
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
Risk Scores
CVSS 3.1
3.299999952316284
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | libheif | 1.21.2-4, 1.21.2-3, 1.21.2-2 |
| Debian:11 | libheif | 1.19.1-1~bpo12+2, 1.19.3-1, 1.19.3-1~bpo12+1 |
| Debian:14 | libheif | 1.20.2-2, 0, 1.20.1-1 |
| Debian:12 | libheif | 1.16.2-1, 1.16.2-2, 1.16.2-3 |
Timeline
- Mar 11, 2026 CVE Published
- Apr 28, 2026 CVE Updated