CVE-2026-3949: strukturag libheif HEIF File decoder_vvdec.cc vvdec_push_data2 out-of-bounds

Published Mar 11, 2026
·
Updated

A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdecpushdata2 of the file libheif/plugins/decodervvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.

Affected Software

1 affected component
libheif<=1.21.2

Event History

Mar 11, 2026
CVE Published
via MITRE·06:32 PM
Data Sourced
via MITRE·06:32 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Jan 29, 58178
Event
via FIRST·10:50 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-3949?

CVE-2026-3949 is classified as a high-severity vulnerability due to the potential for out-of-bounds access in the HEIF file decoder.

2

How do I fix CVE-2026-3949?

To fix CVE-2026-3949, upgrade the libheif library to a version beyond 1.21.2 that includes the necessary security patches.

3

What are the potential impacts of CVE-2026-3949?

Exploitation of CVE-2026-3949 could lead to application crashes or arbitrary code execution when processing HEIF files.

4

Who is affected by CVE-2026-3949?

CVE-2026-3949 affects users and applications that utilize version 1.21.2 or earlier of the strukturag libheif library.

5

Is CVE-2026-3949 being actively exploited?

As of now, there are no public reports indicating active exploitation of CVE-2026-3949, but organizations should apply mitigations promptly.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203