TI-2026-03415 Aliases CVE-2026-3950 GHSA-cp66-x46c-28rg

strukturag libheif stsz/stts track.cc load out-of-bounds

MEDIUM 55CWE-119Published 2026-03-11 · Updated 2026-03-11

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00155 4th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
strukturag	libheif	1.21.0; 1.21.1; 1.21.2	—	No fix listed	CNA

libheif Vendorstrukturag Affected 1.21.0; 1.21.1; 1.21.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:struktur:libheif::::::::	—	—	strukturag

cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:* Versions — — ·strukturag

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Enterprise Linux 10

Timeline

2026-10-02 Threatist record created from CVE-2026-3950
2026-10-03 Alias added: GHSA-cp66-x46c-28rg

References

Exploit 1

https://github.com/Niebelungen-D/pocs/tree/main/heif_dec_sequence_chunk_idx_oob

Patch 1

https://github.com/strukturag/libheif/pull/1721

Other 2

TI-2026-57994 libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items CVSS 3.1CRITICAL 9.8
TI-2026-25594 NULL Pointer Dereference in libde265 CVSS 4.0HIGH 8.7
TI-2023-27026 Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the… CVSS 3.1HIGH 8.8
TI-2023-27020 libheif v1.17.5 was discovered to contain a segmentation violation via the function… CVSS 3.1HIGH 8.8
TI-2026-58037 Resource allocation without limits in strukturag libheif CVSS 3.1HIGH 7.5
TI-2026-57995 libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS CVSS 3.1HIGH 7.5

See all 113 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences