Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Struktur

First CVE: Apr 23, 2019Active for: 7 yearsTotal CVEs: 82
30.4
VTI Score
Low

Struktur maintains a narrowly scoped but strategically important portfolio of open-source multimedia libraries, particularly libde265 and libheif, which provide low-level encoding and decoding for HEIF image and HEVC video formats and are embedded across a broad range of consumer devices, media applications, and image-processing tools. Despite the focused product footprint, the vendor's vulnerability profile is well-represented in the landscape, reflecting the pervasive deployment of these libraries in image and video handling stacks where memory safety is critical. The recurring weakness classes—including out-of-bounds writes and reads, NULL pointer dereferences, and classic buffer overflows—concentrate in the parsing and codec-handling logic characteristic of multimedia decoders, where untrusted input processing creates a consistent attack surface. Defenders should inventory products and services that depend on these libraries, as a single flaw in the codec tier can propagate to numerous downstream consumers and may warrant forced updates across media pipelines. Live severity, exploitation, and exposure counts are shown alongside this summary.

FAUCET AI Generated
82
Total CVEs
More Total CVEs than 99% of tracked vendors
5.9
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 98% of tracked vendors
7.0
Avg CVSS Score
Higher Avg CVSS Score than 50% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Struktur over time

Volume of CVEsAvg CVSS Base Score
First CVE
Apr 23, 2019
7 years ago
Most Recent CVE
Jun 19, 2026
35 days ago

Products(2 total)

Top CVEs

Signals from CVEs in this vendor scope (82 CVEs).

82 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2026-32740HIGH
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an
May 19, 20268.837NONO
CVE-2026-49346HIGH
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed
Jun 19, 20267.131NONO
CVE-2026-49295HIGH
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::p
Jun 19, 20267.131NONO
CVE-2026-41071HIGH
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist
May 22, 20268.131NONO
CVE-2026-49271MEDIUM
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset
Jun 19, 20266.528NONO
CVE-2020-21598HIGH
libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a file.
Sep 16, 20218.828NONO
CVE-2020-19499HIGH
An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid mem
Jul 21, 20218.828NONO
CVE-2026-41069MEDIUM
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing
May 22, 20266.527NONO
CVE-2020-19498HIGH
Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.
Jul 21, 20218.827NONO
CVE-2019-11471HIGH
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.
Apr 23, 20198.827NONO
View all 82 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products82 CVEs
62%
37%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local18 (22.0%)
Network64 (78.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low82 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None7 (8.5%)
Unknown0 (0.0%)
Required75 (91.5%)
Privileges Required
Low1 (1.2%)
High0 (0.0%)
None81 (98.8%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (82 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Struktur.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Struktur — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Struktur's Products

View all 3 CNAs →

Top CWEs