CVE-2026-3950: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3950 is an out-of-bounds read vulnerability in strukturag libheif affecting versions up to and including 1.21.2 (specifically 1.21.0, 1.21.1, and 1.21.2). The flaw resides in the Track::load function within libheif/sequences/track.cc, triggered when processing malformed HEIF sequence files with inconsistent stsz/stts and stsc box data. It was reported on February 24, 2026, publicly disclosed on March 11, 2026, and a fix was merged into the upstream repository on May 17, 2026. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119 / CWE-125). In Track::load(), the code checks whether stsc entries overflow the stsz sample count but does not enforce that stsc fully covers all declared stsz/stts samples — leaving current_sample_idx != m_stsz->num_samples() after the loop as an undetected error. This causes Track::init_sample_timing_table() to emit a chunkIdx equal to m_chunks.size() (an out-of-bounds index), which is then used without bounds checking in Track_Visual::decode_next_image_sample() at track_visual.cc:206, resulting in a heap-buffer-overflow read confirmed by AddressSanitizer. Exploitation requires local access and is triggered by processing a specially crafted HEIF sequence file via CLI tools such as heif-dec -S or heif-view (GitHub Issue #1715, PoC Repository).

Successful exploitation causes a denial of service through application crash (heap-buffer-overflow read) when a local, low-privileged user processes a maliciously crafted HEIF sequence file. There is no impact on confidentiality or integrity — only availability is affected, limited to the process handling the malformed file. The vulnerability does not enable lateral movement or data exfiltration, and its scope is confined to the affected application instance (Red Hat Bugzilla, GitHub Issue #1715).

A public proof-of-concept HEIF file (seq_stsc_underflow_idx_oob.heif) and reproduction steps are available in a public GitHub repository, making exploitation straightforward for anyone with local access to a vulnerable system. The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. The EPSS score is approximately 0.013% (0.000130), indicating low probability of widespread automated exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (PoC Repository, Red Hat Advisory).

1. Obtain the PoC file: Download or craft a malformed HEIF sequence file (seq_stsc_underflow_idx_oob.heif) where the stsz/stts boxes declare more samples than are covered by the stsc box, creating an inconsistency that libheif does not reject during parsing.
2. Gain local access: Ensure local access (low-privileged user) to a system running libheif version 1.21.0–1.21.2.
3. Trigger sequence decoding: Execute the libheif CLI tool targeting the crafted file:

   ASAN_OPTIONS=detect_leaks=0:abort_on_error=1 \
   LD_LIBRARY_PATH=/path/to/libheif \
   heif-dec -S seq_stsc_underflow_idx_oob.heif -o /tmp/out.jpg

   Alternatively, use heif-view with the same file.
4. Trigger the OOB read: During Track::load(), the incomplete stsc coverage goes undetected; Track::init_sample_timing_table() then generates an out-of-bounds chunkIdx equal to m_chunks.size().
5. Achieve denial of service: Track_Visual::decode_next_image_sample() dereferences m_chunks[chunk_idx] with the invalid index, causing a heap-buffer-overflow read and crashing the application (GitHub Issue #1715, PoC Repository).

• Process: Unexpected crash or abnormal termination of heif-dec, heif-view, or any application embedding libheif when processing HEIF sequence files; AddressSanitizer output referencing Track_Visual::decode_next_image_sample() or track_visual.cc:206.
• Logs: Application crash logs or core dumps referencing heap-buffer-overflow in std::__shared_ptr::get() or m_chunks[chunk_idx] within the libheif call stack.
• File System: Presence of crafted HEIF files with anomalous stsz/stts vs. stsc sample count discrepancies; specifically files named seq_stsc_underflow_idx_oob.heif or similar fuzzing artifacts in temporary or upload directories.
• Network: Download of PoC files from https://github.com/Niebelungen-D/pocs/tree/main/heif_dec_sequence_chunk_idx_oob in proxy or web filter logs (GitHub Issue #1715).

The fix was merged into the libheif master branch on May 17, 2026 (PR #1721), adding a post-loop validation that enforces current_sample_idx == m_stsz->num_samples() after processing stsc entries, and returning an input error for malformed files. Users should upgrade to a version incorporating this fix (v1.23.0 or later is available as of May 2026). As an interim workaround, restrict local access to systems running vulnerable libheif versions and avoid processing HEIF sequence files from untrusted sources. Distributions such as openSUSE have issued security announcements tracking this fix (GitHub PR #1721, libheif Repository, Red Hat Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2446751) and assigned it low priority/severity, reflecting its local-only attack vector and limited impact. The fix was contributed by the original reporter (Niebelungen-D) via pull request and merged by libheif maintainer farindk on May 17, 2026, with the maintainer thanking the contributor. openSUSE issued a security announcement to its users. No significant broader media coverage or social media discussion has been identified beyond standard CVE tracking aggregators (Red Hat Bugzilla, GitHub PR #1721).