A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.
CVSS Details
- CVSS 4.0 Base Score: 1.9 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade libheif-openjpegUpgrade libheif-ffmpegUpgrade libheif-aomUpgrade libheif-dav1dUpgrade libheif-jpegUpgrade libheif1Upgrade libheif-svtencUpgrade libheif-rav1eUpgrade libheif-develUpgrade gdk-pixbuf-loader-libheifUpgrade libheif-openh264 | Jun 24, 2026 | Jun 24, 2026 |
| Ubuntu | — | Upgrade libheif-plugin-rav1eUpgrade libheif1Upgrade libheif-plugin-jpegdecUpgrade libheif-plugin-ffmpegdecUpgrade libheif-plugin-kvazaarUpgrade heif-gdk-pixbufUpgrade libheif-plugin-libde265Upgrade heif-thumbnailerUpgrade libheif-plugin-dav1dUpgrade libheif1 (Ubuntu Pro)Upgrade heif-viewUpgrade libheif-plugin-aomdecUpgrade libheif-plugin-j2kencUpgrade libheif-plugin-j2kdecUpgrade libheif-plugin-aomencUpgrade heif-gdk-pixbuf (Ubuntu Pro)Upgrade libheif-dev (Ubuntu Pro)Upgrade libheif-devUpgrade libheif-plugins-allUpgrade heif-thumbnailer (Ubuntu Pro)Upgrade libheif-plugin-jpegencUpgrade libheif-plugin-svtencUpgrade libheif-plugin-x265 | Jun 21, 2026 | Jun 18, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub