{"id":"CVE-2020-19499","details":"An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.","modified":"2026-08-07T15:14:20.056194Z","published":"2021-07-21T18:15:09.167Z","references":[{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/f7399b62d7fbc596f1b2871578c1d2053bedf1dd"},{"type":"EVIDENCE","url":"https://github.com/strukturag/libheif/issues/138"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"fca25874bb8021dede702bb7023a22af1a8a06ab"},{"last_affected":"fca25874bb8021dede702bb7023a22af1a8a06ab"},{"fixed":"f7399b62d7fbc596f1b2871578c1d2053bedf1dd"}],"database_specific":{"cpe":"cpe:2.3:a:struktur:libheif:1.4.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.4.0"},{"last_affected":"1.4.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.4.0","v1.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-19499.json","vanir_signatures_modified":"2026-08-07T15:14:20Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/f7399b62d7fbc596f1b2871578c1d2053bedf1dd","target":{"file":"libheif/heif_context.cc","function":"HeifContext::get_id_of_non_virtual_child_image"},"deprecated":false,"digest":{"function_hash":"298365236335932029718948655364595063960","length":551},"id":"CVE-2020-19499-3ed6b852"},{"digest":{"line_hashes":["95267164885634210382392158749447266934","83457711232404756495386676341864987400","111503610894445712197809965462065388581","77959063699929980087287118117281578552"],"threshold":0.9},"id":"CVE-2020-19499-7b3219ee","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/f7399b62d7fbc596f1b2871578c1d2053bedf1dd","target":{"file":"libheif/heif_context.cc"},"deprecated":false}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}