Hi,

The following vulnerability was published for libheif.

CVE-2026-3950[0]:
| A vulnerability was identified in strukturag libheif up to 1.21.2.
| This impacts the function Track::load of the file
| libheif/sequences/track.cc of the component stsz/stts. The
| manipulation leads to out-of-bounds read. The attack needs to be
| performed locally. The exploit is publicly available and might be
| used. Applying a patch is the recommended action to fix this issue.
| The patch available is inofficial and not approved yet.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-3950
https://www.cve.org/CVERecord?id=CVE-2026-3950
[1] https://github.com/strukturag/libheif/issues/1715

Rgards,
Salvatore