CVE-2026-3950

A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.

libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk. (CVE-2026-32738) libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup. (CVE-2026-32739) Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing. (CVE-2026-32740) libheif has a heap buffer overflow in decode_mask_image(). (CVE-2026-32741) Uninitialized Heap Memory Information Leak via Failed Grid Tiles. (CVE-2026-32814) Heap Buffer OOB Read in overlay compositing due to wrong alpha stride. (CVE-2026-32882) strukturag libheif stsz/stts track.cc load out-of-bounds. (CVE-2026-3950) libheif allows Out-of-bounds vector access leading to invalid dereference (DoS). (CVE-2026-41069) Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count. (CVE-2026-41071) A critical heap-based buffer overflow vulnerability exists in libheif v1.21.2 (and likely earlier versions) within the handling of uncompressed HEIF images (ISO/IEC 23001-17, unci item type). When processing a tiled image with chroma subsampling (e.g., 4:2:0 or 4:2:2), the library fails to scale spatial offsets for the chroma planes. This leads to out-of-bounds memory writes when decoding any tile other than the top-left one, potentially resulting in remote code execution. (CVE-2026-47178) Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder. (CVE-2026-49271)

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.22.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).

• CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541).

• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).

• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).

• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).

• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).

• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).

• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).

• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).

• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).

• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).

• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).

• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).

• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).

• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).

• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).

• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).

• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).

• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).

• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).

• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).

• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).

• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).

• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).

• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

• update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance

• update to 1.22.2:

• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can now convert to WebP (thanks to @torusrxxx).
• heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB).
• TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs,…

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).

• CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541).

• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).

• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).

• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).

• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).

• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).

• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).

• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).

• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).

• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).

• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).

• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).

• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).

• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).

• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).

• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).

• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).

• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).

• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).

• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).

• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).

• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).

• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).

• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

• update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance

• update to 1.22.2:

• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can now convert to WebP (thanks to @torusrxxx).
• heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB).
• TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs,…

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).
• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).
• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).
• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).
• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).
• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).
• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).
• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).
• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).
• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).
• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).
• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).
• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).
• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).
• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).
• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).
• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).
• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).
• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).
• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).
• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).
• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).
• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).
• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

Changes for libheif:

• version update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance
• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• CVE-2026-50142 (GHSA-jvmp-j3cw-84mh) - unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

• version update to 1.22.2:

• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)
• CVE-2026-49271 (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder
• CVE TBD (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask region API when source mask exceeds declared region

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can…