Skip to main content

Libheif CVE-2025-43966

LOW
NULL Pointer Dereference (CWE-476)
2025-04-21 cve@mitre.org
Null Pointer Dereference Denial Of Service Libheif
2.9
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
2.9 LOW
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:38 vuln.today
Patch released
Mar 28, 2026 - 18:38 nvd
Patch available
CVE Published
Apr 21, 2025 - 00:15 nvd
LOW 2.9

DescriptionCVE.org

libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.

AnalysisAI

libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc. Rated low severity (CVSS 2.9), this vulnerability is no authentication required.

Technical ContextAI

This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc. Affected products include: Struktur Libheif. Version information: before 1.19.6.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.

Share

CVE-2025-43966 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy