PT-2026-24787

CVE-2026-3949

Published

2026-02-23

Updated

2026-07-22

Description by

CVSS 3.1

3.3

Low

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions strukturag libheif versions up to 1.21.2

Description A flaw exists in strukturag libheif that allows for an out-of-bounds read. The issue resides in the vvdec push data2 function within the libheif/plugins/decoder vvdec.cc file of the HEIF File Parser component. Manipulating the size argument can trigger the flaw. The attack requires local access. The exploit has been publicly disclosed.

Recommendations Implement patch b97c8b5f198b27f375127cd597a35f2113544d03 to correct this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Biniam

Vendors

Affected products

Weakness enumeration

CWE-125: Out-of-bounds Read

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer