Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-3950

strukturag libheif stsz/stts track.cc load out-of-bounds

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

strukturag libheif

  • 1.21.0affected
  • 1.21.1affected
  • 1.21.2affected

References