CVE-2026-3950

A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.

• CWE-119
• CWE-125

• https://github.com/Niebelungen-D/pocs/tree/main/heif_dec_sequence_chunk_idx_oob
• https://github.com/strukturag/libheif/
• https://github.com/strukturag/libheif/issues/1715
• https://github.com/strukturag/libheif/pull/1721
• https://vuldb.com/?ctiid.350382
• https://vuldb.com/?id.350382
• https://vuldb.com/?submit.766431

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39494Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2026-39495Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2026-39496Improper Neutralization of Special Elements used in an SQL C…7.6
• CVE-2026-39497Improper Neutralization of Special Elements used in an SQL C…7.6
• CVE-2026-39498Shop manager PHP Object Injection in YayMail <= 4.3.3 versio…7.2
• CVE-2026-39499Shop manager PHP Object Injection in Advanced Product Fields…7.2
• CVE-2026-39500Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-39501Missing Authorization vulnerability in RealMag777 FOX woocom…5.3
• CVE-2026-39502Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15…9.3
• CVE-2026-39503Unauthenticated Broken Access Control in Easy Digital Downlo…7.5
• CVE-2026-39504Missing Authorization vulnerability in InstaWP InstaWP Conne…5.4
• CVE-2026-39505Missing Authorization vulnerability in Craig Hewitt Seriousl…5.3