CVE-2026-3950 strukturag libheif stsz/stts track.cc load out-of-bounds
An out-of-bounds read in libheif allows local attackers to cause denial of service or disclose memory contents via crafted files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3950?
CVE-2026-3950 is a medium-severity memory corruption vulnerability in strukturag libheif, published on 11 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.
Which versions are affected by CVE-2026-3950?
How do I fix CVE-2026-3950?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-3950 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3950 exists.
Sources
Also known as DEBIAN-CVE-2026-3950, GHSA-cp66-x46c-28rg, UBUNTU-CVE-2026-3950.