Nokia Heif vulnerabilities

3 CVEs affecting Nokia Heif, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-32289, published 2021-09-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-32288, published 2021-09-20. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicHeight() located in hevcdecoderconfigrecord.cpp. It allows an…
CVE-2021-32287, published 2021-09-20. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicWidth() located in hevcdecoderconfigrecord.cpp. It allows an…
CVE-2021-32289, published 2021-09-20. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. An issue was discovered in heif through through v3.6.2. A NULL pointer dereference exists in the function convertByteStreamToRBSP() located in nalutil.cpp. It allows an attacker to cause Denial of…