A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1660-1 advisory.

    - CVE-2026-3949: Manipulation of the argument size of a malicious frame can lead to out-of-bounds read     (bsc#1259541).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1509 advisory.

    A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function     vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing     a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched     locally. The exploit has been publicly disclosed and may be utilized. This patch is called     b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
    (CVE-2026-3949)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function     vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing     a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched     locally. The exploit has been publicly disclosed and may be utilized. This patch is called     b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
    (CVE-2026-3949)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
311738	SUSE SLED15 / SLES15 Security Update : libheif (SUSE-SU-2026:1660-1)	Nessus	SuSE Local Security Checks	medium
304580	Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1509)	Nessus	Amazon Linux Local Security Checks	medium
302000	Linux Distros Unpatched Vulnerability : CVE-2026-3949	Nessus	Misc.	low

Detections

Analytics

CVE-2026-3949

medium

Tenable Plugins

medium

medium

low