Struktur Ag · Libheif · CVE-2026-3950
**Name of the Vulnerable Software and Affected Versions**
strukturag libheif versions up to 1.21.2
**Description**
A flaw exists in strukturag libheif, specifically within the `Track::load` function located in the `libheif/sequences/track.cc` file, related to the `stsz/stts` component. This can lead to an out-of-bounds read condition. The attack requires local access. An exploit for this issue is publicly available.
**Recommendations**
Apply a patch to address this issue. Note that the available patch is currently unofficial and not yet approved.