CVE-2026-3949: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3949 is an out-of-bounds read vulnerability in strukturag libheif affecting versions up to and including 1.21.2. The flaw resides in the vvdec_push_data2() function within libheif/plugins/decoder_vvdec.cc, where a 32-bit NAL unit size is read from the input buffer and used to copy data without validating that sufficient bytes remain in the buffer. It was reported on February 23, 2026, and published on March 11, 2026. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.9 (Low) (Red Hat CVE, GitHub Issue).

The root cause is missing length validation in the vvdec_push_data2() function (CWE-125: Out-of-bounds Read; CWE-805: Buffer Access with Incorrect Length Value). The function reads a 32-bit size value from the first four bytes of the frame data buffer, then immediately copies size bytes into a std::vector via nalu.insert(nalu.end(), data, data + size) without first checking that size <= frame_size - 4. This allows an attacker to craft a malicious HEIF file where the declared NAL unit length exceeds the actual available data, triggering a heap buffer overflow read. A comparable function in decoder_libde265.cc (libde265_v1_push_data2()) correctly implements a bounds check that is absent here. The attack requires local access and low privileges; exploitation requires processing a crafted HEIF file (GitHub Issue, PoC Repository, Fix Commit).

Successful exploitation can cause a denial-of-service condition through application crash due to heap buffer overflow read, as confirmed by AddressSanitizer output showing a READ of size 16 beyond the allocated 8-byte region. There is no direct impact on confidentiality or integrity — the vulnerability affects only availability (CVSS availability impact: Low). The scope is limited to the local system running an affected libheif build with the vvdec plugin enabled, and there is no evidence of lateral movement potential or sensitive data exposure (GitHub Issue, Red Hat CVE).

A proof-of-concept HEIF file (poc_vvdec_oob_read.heif) has been publicly disclosed by the reporter (GitHub user biniamf) and is available in a public repository (PoC Repository). However, exploitation requires local access with low privileges and is only possible when libheif is built with the vvdec plugin (-DWITH_VVDEC=ON), limiting the practical attack surface. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the wild. No in-the-wild exploitation has been observed, no threat actor attribution exists, and the vulnerability is not listed in the CISA KEV catalog (Red Hat CVE).

1. Identify target: Locate a system running strukturag libheif version 1.21.0–1.21.2 compiled with the vvdec decoder plugin enabled (-DWITH_VVDEC=ON), and with local access to the system.
2. Craft malicious HEIF file: Create a structurally valid HEIF file containing a VVC-encoded image item whose compressed data extent includes a length-prefixed NAL unit where the declared 32-bit size value exceeds the actual remaining bytes in the buffer (e.g., set the first 4 bytes to a large value like 0xFFFFFFFF while providing only a small data buffer).
3. Trigger decoding: Execute a libheif-based application (e.g., heif-dec poc_vvdec_oob_read.heif /tmp/out.y4m) that processes the crafted file, causing vvdec_push_data2() to read the oversized size field and attempt to copy beyond the allocated buffer.
4. Achieve denial of service: The out-of-bounds read triggers a heap buffer overflow, causing the application to crash (confirmed via AddressSanitizer as a heap-buffer-overflow in memcpy/uninitialized_copy) (GitHub Issue, PoC Repository).

• File System: Presence of crafted .heif files with anomalous NAL unit size fields (first 4 bytes of compressed data extent encoding a value far exceeding the file's actual data size); unexpected HEIF files in user-accessible directories.
• Process: Abnormal crashes or core dumps from libheif-based applications (e.g., heif-dec, image viewers, or media processing pipelines) with stack traces referencing vvdec_push_data2 in libheif.so; AddressSanitizer reports of heap-buffer-overflow in uninitialized_copy or memcpy originating from libheif.so.
• Logs: Application crash logs or coredump entries showing aborts in libheif.so at the vvdec_push_data2 symbol; system logs indicating repeated crashes of image processing services when handling HEIF files (GitHub Issue).

Apply the upstream fix by updating libheif to a version incorporating commit b97c8b5f198b27f375127cd597a35f2113544d03, which adds bounds checks before reading the NAL unit size and before copying data, returning a heif_error_Decoder_plugin_error with heif_suberror_End_of_data when the buffer is insufficient. Affected versions are libheif 1.21.0, 1.21.1, and 1.21.2; users should upgrade to a version newer than 1.21.2. As a workaround where upgrading is not immediately possible, disable or avoid building libheif with the vvdec plugin (-DWITH_VVDEC=OFF) and restrict local access to systems processing untrusted HEIF files (Fix Commit, Red Hat CVE).

Red Hat has tracked this vulnerability and assigned it a Bugzilla entry (bug #2446725), though it has not issued a formal advisory beyond the CVE tracking page. SUSE Linux has issued a security advisory (SUSE-2026-1660-1) rating the issue as Low severity. Detection coverage has been added by Tenable (Nessus plugin 302000 and 311738) and Qualys (plugin 762374). No significant public researcher commentary or social media discussion beyond the original GitHub issue report has been observed (Red Hat CVE, Linux Security SUSE).