CVE-2026-3950: libheif Buffer Overflow Vulnerability

CVE-2026-3950 Overview

A vulnerability was identified in strukturag libheif up to version 1.21.2. This out-of-bounds read vulnerability impacts the function Track::load within the file libheif/sequences/track.cc of the stsz/stts component. The manipulation of image sequence data leads to an out-of-bounds read condition. The attack requires local access to the system, and a proof-of-concept exploit has been publicly disclosed. An unofficial patch is available but has not yet been approved by the maintainers.

Critical Impact

Local attackers can trigger an out-of-bounds read in libheif's image sequence processing, potentially causing denial of service or information disclosure when processing maliciously crafted HEIF/HEIC image files.

Affected Products

• strukturag libheif versions up to and including 1.21.2
• Applications and services utilizing libheif for HEIF/HEIC image processing
• Image viewers, converters, and media applications with libheif dependencies

Discovery Timeline

• 2026-03-11 - CVE-2026-3950 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3950

Vulnerability Analysis

This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw exists in the Track::load function responsible for parsing image sequence data within HEIF container files. Specifically, the vulnerability occurs when processing the stsz (sample size) and stts (time-to-sample) box atoms, which define how samples are organized within a track.

When a maliciously crafted HEIF file contains manipulated chunk index values, the parsing logic fails to properly validate boundaries before accessing memory. This results in an out-of-bounds read operation that can expose adjacent memory contents or cause application crashes.

The attack requires local access, meaning an attacker must either have the ability to place a malicious file on the target system or convince a user to open a crafted HEIF/HEIC image file.

Root Cause

The root cause lies in insufficient bounds checking within the Track::load function when handling the chunk index (chunk_idx) during image sequence decoding. The code processes sample-to-chunk mappings without adequately verifying that the computed indices fall within the allocated buffer boundaries for the stsz and stts box data structures.

Attack Vector

The attack vector requires local access to the target system. An attacker would need to:

1. Craft a malicious HEIF/HEIC file with manipulated stsz or stts box atoms containing invalid chunk indices
2. Deliver the file to the victim through social engineering, file sharing, or by placing it in a location where automatic image processing occurs
3. When the victim opens or previews the image using an application linked against a vulnerable libheif version, the out-of-bounds read is triggered

The vulnerability has been publicly documented with a proof-of-concept available at the GitHub PoC Repository. Technical discussion of the issue can be found in GitHub Issue #1715.

Detection Methods for CVE-2026-3950

Indicators of Compromise

• Unexpected application crashes when processing HEIF/HEIC image files
• Memory access violations or segmentation faults in applications using libheif
• Presence of unusually structured HEIF files with malformed stsz or stts box atoms
• AddressSanitizer (ASan) reports indicating out-of-bounds read in track.cc

Detection Strategies

• Deploy memory safety tools (ASan, MSan) in development and testing environments to detect out-of-bounds access
• Monitor application crash dumps for stack traces involving Track::load or related libheif functions
• Implement file integrity checks for HEIF/HEIC files processed by critical systems
• Use endpoint detection and response (EDR) solutions to identify anomalous behavior during image processing

Monitoring Recommendations

• Enable verbose logging for image processing applications to capture parsing failures
• Monitor system logs for recurring crashes in applications that handle HEIF/HEIC media
• Implement alerting on unusual file access patterns involving HEIF/HEIC files from untrusted sources
• Review application stability metrics for services dependent on libheif

How to Mitigate CVE-2026-3950

Immediate Actions Required

• Identify all systems and applications using libheif version 1.21.2 or earlier
• Restrict processing of HEIF/HEIC files from untrusted sources until patching is complete
• Consider temporarily disabling HEIF/HEIC support in production environments where feasible
• Review and apply the unofficial patch referenced in GitHub Pull Request #1721 after appropriate testing

Patch Information

An unofficial patch addressing this vulnerability is available via GitHub Pull Request #1721. Note that this patch has not yet been officially approved by the libheif maintainers. Organizations should evaluate the patch in their testing environments before deployment and monitor the libheif repository for an official release incorporating the fix.

Workarounds

• Disable HEIF/HEIC image sequence processing if not required by business operations
• Implement input validation to reject HEIF files with suspicious stsz/stts box structures before processing
• Use sandboxed environments for processing untrusted image files to limit impact of exploitation
• Configure applications to use alternative image formats (PNG, JPEG) where HEIF is not essential

# Configuration example - Restrict HEIF processing in ImageMagick
# Add to /etc/ImageMagick-6/policy.xml or equivalent
# <policy domain="coder" rights="none" pattern="HEIC" />
# <policy domain="coder" rights="none" pattern="HEIF" />