PT-2026-76136

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::init sample timing table in libheif/sequences/track.cc stores an out-of-bounds chunk index m chunks.size into m presentation timeline when the number of chunks defined in the stco box is less than the numb...

CVE-2026-47254: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...