Skip to main content

libheif CVE-2026-41069

MEDIUM
Out-of-bounds Read (CWE-125)
2026-05-22 GitHub_M
Information Disclosure Buffer Overflow Libheif
6.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Source Code Evidence Fetched
May 22, 2026 - 21:16 vuln.today
Analysis Generated
May 22, 2026 - 21:16 vuln.today

DescriptionGitHub Advisory

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count 0 (creating no chunks) while still passing validation because saio.entry_count 0 matches, but with saiz.sample_count > 0 the SampleAuxInfoReader constructor still enters its loop. This leads to an out-of-bounds dereference on the empty chunks[0] in chunked mode.

AnalysisAI

Out-of-bounds read in libheif versions 1.21.2 and prior crashes any application that parses attacker-controlled HEIF sequence files, resulting in denial of service. The defect lives in the SampleAuxInfoReader constructor, which enters its processing loop when saiz.sample_count > 0 even though stco.entry_count == 0 left the chunks vector empty; dereferencing chunks[0] then triggers the crash. No public exploit code has been identified at time of analysis, but the attack requires only that a user open or process a specially crafted HEIF file, making it relevant wherever libheif is embedded in image-handling applications (browsers, media libraries, operating-system image stacks). Vendor-released patch v1.22.0 is available.

Technical ContextAI

libheif (CPE: cpe:2.3:a:strukturag:libheif:*:*:*:*:*:*:*:*, versions up to and including 1.21.2) is an open-source C++ library for decoding and encoding the High Efficiency Image File Format (HEIF) and AVIF. The flaw is rooted in the sequence-track parsing logic that handles auxiliary sample information - the data structures stco (chunk offset box), saio (sample auxiliary information offsets box), and saiz (sample auxiliary information sizes box). The library validates saio.entry_count 0 as a sufficient signal that no auxiliary chunks are expected, but does not cross-check saiz.sample_count before constructing a SampleAuxInfoReader in chunked mode. When a malicious file sets stco.entry_count 0 alongside saiz.sample_count > 0, the constructor enters its iteration loop and dereferences chunks[0] on an empty vector - a classic CWE-125 (Out-of-Bounds Read) caused by missing bounds enforcement across correlated fields from separate boxes. The tags on this advisory include 'Buffer Overflow' and 'Information Disclosure', but the CVSS vector records Confidentiality: None; the out-of-bounds read likely crashes the process before any memory content is surfaced, making DoS the confirmed impact at this time.

RemediationAI

Upgrade libheif to version 1.22.0, which is confirmed as the vendor-released patch per the GitHub release at https://github.com/strukturag/libheif/releases/tag/v1.22.0 and the security advisory at https://github.com/strukturag/libheif/security/advisories/GHSA-p82x-fpmv-576r. Downstream package maintainers should rebuild against 1.22.0; statically-linked applications must be recompiled. If immediate upgrade is not possible, the most effective compensating control is to reject or sandbox HEIF sequence files at the application or ingestion-pipeline boundary before they reach libheif - for example, by blocking HEIF/AVIF files at a content-type filter or stripping sequence-type tracks in a pre-processing step. This reduces attack surface but may break legitimate multi-frame HEIF content. Alternatively, running the libheif decoding process in an isolated sandbox (container, seccomp profile, or separate worker process) limits a crash to DoS of that worker rather than the parent application. Note: the v1.22.0 release is a large functional update with new codec architecture (ISO/IEC 23001-17 rewrite, generic image components); validate application compatibility with the new release before wide deployment.

More in Libheif

View all
CVE-2023-49464 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
CVE-2023-49463 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
CVE-2023-49462 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
CVE-2023-49460 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
CVE-2019-11471 HIGH POC
8.8 Apr 23

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
CVE-2024-41311 HIGH POC
8.1 Oct 15

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
CVE-2024-25269 HIGH POC
7.5 Mar 05

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
CVE-2023-29659 MEDIUM POC
6.5 May 05

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
CVE-2025-29482 MEDIUM POC
6.2 Apr 07

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
CVE-2026-32740 HIGH
8.8 May 19

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr
CVE-2023-0996 HIGH
7.8 Feb 24

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi
CVE-2026-32741 HIGH
7.1 May 19

Heap buffer overflow in libheif versions 1.21.2 and below allows remote attackers to corrupt memory via a maliciously cr

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2016-1646 HIGH POC
8.8
CVE-2025-5777 HIGH POC
7.5
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-41069 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy