A vulnerability has been found in strukturag libheif up to 1.21.2 and classified as problematic. This impacts the function
Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read.
This vulnerability is documented as CVE-2026-3950. The attack needs to be performed locally. Additionally, an exploit exists.
Applying a patch is the recommended action to fix this issue.
The patch available is inofficial and not approved yet.
