CyberRota Analysis
AI-Generatedlibheif is vulnerable to an integer overflow that allows attackers to bypass a security check, potentially leading to an out-of-bounds heap read when processing specially crafted HEIF files containing VVC tracks. This flaw poses a medium severity risk, as it can be exploited to execute arbitrary code or cause denial of service. Users and organizations utilizing libheif, particularly those handling HEIF or AVIF files, should prioritize updating to version 1.22.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)