CVE-2026-3949

What it actually does

CVE-2026-3949 is an out-of-bounds read in strukturag libheif's HEIF file parser, specifically in the vvdec_push_data2 function in plugins/decoder_vvdec.cc. A malformed HEIF/HEIC file can manipulate a size argument so the decoder reads beyond the intended memory boundary while parsing VVdeC-related image data. The known impact is availability loss, typically process crash or abnormal termination of software that uses vulnerable libheif versions up to 1.21.2. The described impact does not indicate arbitrary code execution, privilege escalation, or data modification, but memory-safety issues in image parsers should still be treated carefully because they are often reachable through automated file-processing workflows.

Why it matters to the business

Organizations using vulnerable libheif builds may experience crashes in applications, desktop tools, media pipelines, thumbnailers, content-management systems, or backend services that parse HEIF/HEIC images. The CVSS score and EPSS probability are low, it is not in CISA KEV, and there is no ransomware association reported, but public disclosure means proof-of-concept or exploit details may be available. The main operational risk is denial of service or instability when untrusted image files are processed, especially in systems that automatically ingest user-supplied media.

How an attack unfolds

An attacker obtains the ability to place or submit a crafted HEIF/HEIC file to software that uses a vulnerable libheif version with the VVdeC decoder path enabled or linked. When the target application opens, previews, indexes, converts, thumbnails, scans, or otherwise parses the file, the malformed size field reaches vvdec_push_data2. The parser then performs an out-of-bounds read, which can cause the consuming process to crash or behave unexpectedly. In a local attack scenario, the attacker may need access to the machine or an account that can cause the vulnerable software to process the malicious file; in automated processing environments, the practical exposure depends on whether untrusted media files are accepted and parsed without isolation.

How to fix it

Upgrade libheif to a version that includes the upstream fix for commit b97c8b5f198b27f375127cd597a35f2113544d03, or apply that patch directly if consuming libheif from source. Because no exact fixed release version was provided in the input, treat versions up to and including 1.21.2 as affected until vendor or distribution packages confirm inclusion of the fix. Rebuild and redeploy all applications statically linked against libheif, because updating the system package alone may not remediate embedded copies. As interim mitigations, restrict processing of untrusted HEIF/HEIC files, disable VVdeC-related decoding if not required, process image files in a sandbox with memory and process isolation, and enforce file-type validation and resource limits on image-processing services.

How to confirm the fix worked

Confirm installed libheif versions using package managers, software bills of materials, container image scans, and binary dependency inspection. Verify that libheif is newer than the affected range or contains upstream commit b97c8b5f198b27f375127cd597a35f2113544d03. For source builds, inspect the libheif repository or package changelog for the patch and rebuild dependent applications. For dynamically linked applications, verify runtime linkage with tools such as ldd, otool, or equivalent platform tooling. For statically linked applications, confirm the embedded libheif version through vendor documentation, SBOM metadata, strings output, or rebuild provenance. If safe test cases are available from the vendor or internal QA, process malformed HEIF samples in a non-production environment and confirm the application no longer crashes.

Typical attack path

1. Identify an application, service, or file-processing workflow that uses strukturag libheif version 1.21.2 or earlier.
2. Craft or obtain a malformed HEIF/HEIC file that manipulates the VVdeC decoder size argument handled by vvdec_push_data2.
3. Place, upload, open, or otherwise cause the vulnerable application to process the crafted file.
4. Trigger HEIF parsing through preview generation, image conversion, indexing, upload validation, or manual opening.
5. Cause an out-of-bounds read in the libheif parser, resulting in process crash or denial of service.

How to detect it

Look for evidence that applications using libheif crashed while processing HEIF/HEIC files. Relevant sources include application logs, image-processing service logs, media upload logs, thumbnailer logs, system crash reports, core dump metadata, endpoint detection telemetry, container logs, and operating-system journal or event logs. Search for crashes or exceptions referencing libheif, decoder_vvdec.cc, vvdec_push_data2, VVdeC, HEIF parsing, or out-of-bounds reads. Correlate crashes with recent file uploads, local file opens, thumbnail generation, image conversion jobs, or indexing activity involving .heif, .heic, or HEIF MIME types. If core dumps are available, inspect stack traces for libheif and vvdec_push_data2. There are no public CVE-specific malware indicators in the provided data, so detection should focus on exploit-like crash patterns, suspicious malformed HEIF inputs, and repeated attempts to trigger parser failures.

• vvdec_push_data2
• decoder_vvdec.cc
• libheif/plugins/decoder_vvdec.cc
• libheif
• VVdeC
• heif_context_read_from_file
• heif_decode_image
• heap-buffer-overflow
• out-of-bounds read
• .heif
• .heic
• image/heif
• image/heic

What your security team should do

• Inventory all systems, containers, desktop applications, media-processing services, and third-party products that include or link against libheif.
• Prioritize patching internet-facing or automated workflows that parse user-supplied HEIF/HEIC files, even though the base vulnerability is described as local.
• Upgrade libheif or apply upstream commit b97c8b5f198b27f375127cd597a35f2113544d03, then rebuild statically linked applications and redeploy affected containers.
• Temporarily restrict or sandbox HEIF/HEIC parsing where patching cannot be completed promptly.
• Monitor crash telemetry and application logs for failures in libheif, VVdeC, image thumbnailing, image conversion, upload validation, or media indexing components.
• Add dependency and container scanning checks for libheif versions up to and including 1.21.2.
• Because EPSS is low, not KEV-listed, and not associated with ransomware, handle as routine but time-bound patching unless the environment processes untrusted image uploads at scale.