libheif vulnerabilities

Several vulnerabilities (two rated critical under CVSSv3) have been discovered and fixed in the upstream libheif dependency. They can lead to remote code execution (RCE) on glibc-based Linux under certain conditions.

libheif from 1.22.0 to 1.23.2 has a heap out-of-bounds write vulnerability. Crafted HEIF/HEIC/AVIF files with nested iden/auxl references cause duplicate Alpha planes with different bit depths, and scale_nearest_neighbor() allocates a buffer based on the first plane's 8-bit depth, leading to an overflow.

A vulnerability in the libheif library used by sharp (which Next.js uses for image optimization) can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length. This issue is fixed in version 1.23.3.

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.

libheif, a HEIF and AVIF decoder and encoder, prior to 1.19.6 has an integer overflow in the width field of Op_RGB24_32_to_YCbCr::convert_colorspace() for extremely large RGB images. This causes an invalid input pointer and an out-of-bounds read during RGB-to-YCbCr conversion, potentially crashing the encoding process.

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.

Vulnerability in libheif (up to 1.23.0) allows application crash via a crafted HEIF sequence that does not register sequence tracks, leading to assertion or undefined behavior when calling heif_context_get_track.

Vulnerability in libheif (versions 1.19.0 to 1.23.1) causing application crash when decoding a crafted uncompressed HEIF image with zlib compression. An offset calculation error leads to out-of-bounds read and crash.

Vulnerability in libheif (up to 1.23.0) allows heap corruption via a crafted image sequence with mismatched alpha plane dimensions, leading to out-of-bounds write during encoding.

Vulnerability in libheif (up to 1.23.0) allows crash or corrupt tiling results via a crafted HEIF/AVIF file with a clean aperture box that reduces dimensions to zero, causing underflow and assertion or incorrect results.

libheif from 1.19.0 to 1.23.0 has a vulnerability allowing unbounded heap allocation when processing a crafted HEIF sequence with msf1 brand. Box_stsz::parse() applies max_sequence_frames only to variable-size samples, and Track::load() uses 32-bit arithmetic that can bypass consistency checks. This can lead to gigabytes of memory allocation, crashing or stalling the process.

libheif versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

Vulnerability in libheif before version 1.22.0. Decoding a malicious HEIF file without an `ispe` property (but with `uncC`) causes a crash in `heif_image_handle_get_image_tiling()` – via assertion in debug builds or null pointer read in release/ASan builds.

Vulnerability in libheif before version 1.22.0 causes a heap buffer overflow when reading HEIF/AVIF files. The Track::init_sample_timing_table() function stores an invalid chunk index, leading to an out-of-bounds read.

Vulnerability in libheif before version 1.22.0. The fix for CVE-2026-3949 introduced an integer overflow in the security check, allowing bypass and triggering an out-of-bounds heap read via a crafted HEIF file with a VVC track.

Two bugs in libheif prior to version 1.22.0 chain to leak process heap memory as visible pixel values in decoded grid images. An attacker uploading a crafted AVIF/HEIC file to a server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data, including library function pointers sufficient to defeat ASLR, from publicly downloadable transcoded JPEG/PNG/WebP output.

Vulnerability in libheif versions 1.19.0 through 1.21.2 allows a heap out-of-bounds write in the uncompressed tile decoder. A crafted HEIF file can overwrite the vtable pointer, leading to code execution.

In libheif versions up to 1.21.2, an integer overflow occurs during inline mask processing in HEIF files. The product of width and height can exceed the maximum 32-bit unsigned value, leading to undersized buffer allocation and out-of-bounds memory access. The issue is fixed in version 1.22.0.

In libheif before 1.22.0, a crafted HEIF file with more samples declared than actually exist causes an out-of-bounds read in the SampleAuxInfoReader constructor. The vulnerability is triggered during file parsing.

An out-of-bounds read vulnerability has been found in libheif versions 1.21.2 and prior during HEIF sequence parsing. A malformed file can cause denial of service (DoS).

In libheif versions up to 1.21.2, a heap buffer over-read exists in HeifPixelImage::overlay(). When compositing an overlay image whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride instead of the alpha stride, causing reads past the end of the alpha buffer.

In libheif before version 1.22.0, when decoding a HEIF grid image with strict_decoding=false, a corrupted tile silently fails and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The Y, Cb, and Cr planes are not zeroed, so heap data appears in pixel values.

libheif versions 1.21.2 and below have a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file with a mask image, the copy length is attacker-controlled and may exceed the destination buffer size.

libheif is a library for decoding and encoding HEIF and AVIF formats. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in grid tile compositing. An attacker can supply a HEIF/AVIF file with a 1×4 grid of odd-height tiles, causing a write of 64 attacker-controlled bytes past the end of allocated memory.

libheif versions 1.21.2 and below are vulnerable to a DoS attack via an infinite loop in Box_stts::get_sample_duration(). A crafted 800-byte HEIF file causes 100% CPU usage with no progress, leading to denial of service. The issue occurs during file opening, before any user interaction.

In libheif (versions 1.21.2 and below), a crafted HEIF file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor, leading to an out-of-bounds read and crash (SEGV) on the first frame access. The file parses without error, but crashes when attempting to display.

libheif before version 1.21.0 has a heap buffer over-read vulnerability in HeifPixelImage::overlay(), triggered by a crafted HEIF file with an overlay image item. This can lead to program crash.