Out-of-bounds Read

🗓️ 11 Mar 2026 20:42:23Reported by Snyk Security DatabaseType

Out-of-bounds read in vvdec_push_data2 of the Heif File Parser; local exploit via size manipulation; fix in master.

Reporter	Title	Published	Views	Family All 29
ATTACKERKB	CVE-2026-3949	11 Mar 202618:32	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1509)	1 Apr 202600:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 Security Update : libheif (SUSE-SU-2026:1660-1)	2 May 202600:00	–	nessus
Tenable Nessus	SUSE SLED15: gdk-pixbuf-loader-libheif / libheif-aom / libheif-dav1d / etc (SUSE-SU-2026:2622-1)	26 Jun 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-3949	12 Mar 202600:00	–	nessus
Amazon	Low: libheif	1 Apr 202600:00	–	amazon
BDU FSTEC	The vulnerability of the vvdec_push_data2() function in the HEIF File Parser component, a decoder and file format parser library, allows a malicious actor to gain unauthorized access to protected information.	13 Apr 202600:00	–	bdu_fstec
CNNVD	libheif 缓冲区错误漏洞	11 Mar 202600:00	–	cnnvd
CVE	CVE-2026-3949	11 Mar 202618:32	–	cve
Cvelist	CVE-2026-3949 strukturag libheif HEIF File decoder_vvdec.cc vvdec_push_data2 out-of-bounds	11 Mar 202618:32	–	cvelist