libheif: A vulnerability was determined in strukturag libheif up to 1.21.2
CVE-2026-3949 is fixed in 8 products on 1 platform, first by DEBIAN-CVE-2026-3949, released March 11, 2026. It is not reported as exploited. Patch Radar priority: Routine.
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| heif-pixbuf-loader · amzn 2023 | 1.19.8-1.amzn2023.0.4 | ALAS2023-2026-1509 | Mar 30, 2026 |
| heif-pixbuf-loader-debuginfo · amzn 2023 | 1.19.8-1.amzn2023.0.4 | ALAS2023-2026-1509 | Mar 30, 2026 |
| libheif · Debian 13.5 (trixie) | 1.23.1-1 | DEBIAN-CVE-2026-3949 | Mar 11, 2026 |
| libheif · Debian 14 | 1.23.1-1 | DEBIAN-CVE-2026-3949 | Mar 11, 2026 |
| libheif · amzn 2023 | 1.19.8-1.amzn2023.0.4 | ALAS2023-2026-1509 | Mar 30, 2026 |
| libheif · opensuse-leap 16.0 | 1.23.0-160000.1.1 | OPENSUSE-SU-2026:20974-1 | Jun 17, 2026 |
| libheif · sles 15.7 | 1.23.0-150700.3.15.1 | SUSE-SU-2026:2622-1 | Jun 24, 2026 |
| libheif · sles 16.0 | 1.23.0-160000.1.1 | SUSE-SU-2026:22153-1 | Jun 17, 2026 |
| libheif-debuginfo · amzn 2023 | 1.19.8-1.amzn2023.0.4 | ALAS2023-2026-1509 | Mar 30, 2026 |
| libheif-debugsource · amzn 2023 | 1.19.8-1.amzn2023.0.4 | ALAS2023-2026-1509 | Mar 30, 2026 |
| libheif-devel · amzn 2023 | 1.19.8-1.amzn2023.0.4 | ALAS2023-2026-1509 | Mar 30, 2026 |
| libheif-tools · amzn 2023 | 1.19.8-1.amzn2023.0.4 | ALAS2023-2026-1509 | Mar 30, 2026 |
| libheif-tools-debuginfo · amzn 2023 | 1.19.8-1.amzn2023.0.4 | ALAS2023-2026-1509 | Mar 30, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.