CVE-2026-3950 — strukturag libheif stsz/stts track.cc load out-of-bounds
A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The m…
Published: 2026-03-11 · CVSS: 4.8 · CVSS 4.0
A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7