libheif CVE-2025-68431

Exploitation requires the victim's application or service to decode an attacker-supplied HEIF/HEIC image that exercises the image-overlay (overlay/iovl derivation) code path in HeifPixelImage::overlay(), where a crafted offset caused a copy width of in_w - in_x0 to read beyond the source buffer. No authentication is required (PR:N), but user interaction IS required (UI:R): a user or automated pipeline must open, preview, or process the malicious file in software linked against vulnerable libheif (< the fixed release; Alpine < 1.21.2-r0). Limiting factors: the overlay/derived-image feature must be triggered, impact is confined to memory disclosure plus crash (no code execution or integrity impact claimed), and the requirement that someone process the file prevents unattended, wormable exploitation.

Signals align toward a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, base 7.1) describes an unauthenticated, low-complexity flaw that nonetheless requires user interaction (UI:R) - a victim must open or process a crafted HEIF image - which meaningfully caps mass-exploitation potential. EPSS is very low at 0.04% (14th percentile), consistent with a client-side memory-safety bug in an image library rather than a server-side RCE. The CWE-125 out-of-bounds read, confirmed by the one-line fix in HeifPixelImage::overlay() (clamping the copy width from in_w - in_x0 back to in_w), limits impact to information disclosure (C:L) and process crash/denial of service (A:H); there is no integrity impact (I:N) and no arbitrary code execution claimed. This is NOT in CISA KEV, so there is no confirmed active exploitation; however, exploit code is reported publicly available, so weaponization against targeted users is plausible. Note a mild tension: the input Tags label this 'Buffer Overflow,' but the CWE-125 classification and the diff indicate an out-of-bounds READ, not a write-based overflow - treat RCE claims with skepticism. Net: a real bug worth patching in image-processing pipelines, but the UI:R requirement and low EPSS argue against emergency prioritization absent evidence of targeting.

An attacker crafts a malicious HEIF/HEIC image with a malformed overlay (image grid/overlay derivation) that drives an out-of-bounds read during HeifPixelImage::overlay(). The victim opens or previews the image in any application or service linked against vulnerable libheif, causing the process to read past the pixel buffer and either leak adjacent heap memory into the output or crash. Publicly available exploit code exists, lowering the barrier for targeted delivery via email, chat, or a web page.