libheif CVE-2026-41071

MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-22 GitHub_M

Information Disclosure Buffer Overflow Libheif

5.1

CVSS 4.0 · Vendor: GitHub_M

Share

Severity by source

Vendor (GitHub_M) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

A

Scope

X

Lifecycle Timeline

4

Source Code Evidence Fetched

Jun 08, 2026 - 13:44 vuln.today

Analysis Generated

Jun 08, 2026 - 13:44 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

5.1 (MEDIUM)

CVE Published

May 22, 2026 - 20:59 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->get_num_samples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments current_chunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heif_context_read_from_file) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.

AnalysisAI

Heap-buffer-overflow in libheif 1.21.2 and prior exposes any application parsing untrusted HEIF sequence files to an out-of-bounds read during file ingestion, with potential for heap memory disclosure or process crash. The flaw is triggered the moment a victim opens a crafted file - no additional interaction beyond file opening is required - making it a practical threat in desktop image viewers, browsers, and media pipelines that embed libheif. No public exploit has been identified at time of analysis, EPSS sits at 0.04% (11th percentile), and a vendor-released patch (v1.22.0) is available, keeping real-world exploitation risk currently assessed as low-moderate despite the memory-corruption class.

Technical ContextAI

libheif (CPE: cpe:2.3:a:strukturag:libheif:*:*:*:*:*:*:*:*) is an open-source C++ library for decoding and encoding HEIF and AVIF container formats built on the ISO Base Media File Format (ISOBMFF). The vulnerable path lies in the SampleAuxInfoReader constructor, which processes the 'saiz' box - an ISOBMFF structure that records per-sample auxiliary information sizes. The constructor iterates from zero up to saiz->get_num_samples() but performs no bounds check against the actual size of the chunks vector, which is populated from the track's chunk offset table. CWE-125 (Out-of-bounds Read) applies: when a crafted saiz box inflates the sample count beyond what the chunks table covers, the loop variable current_chunk is incremented past chunks.size(), causing a read beyond the end of the heap-allocated vector buffer. The flaw exists entirely within the file-parsing phase (heif_context_read_from_file), before any image decoding occurs.

RemediationAI

The primary fix is upgrading to libheif v1.22.0, available at https://github.com/strukturag/libheif/releases/tag/v1.22.0; this release adds bounds validation in the SampleAuxInfoReader constructor to ensure the saiz sample count is checked against the actual chunks vector size before iteration. Downstream package maintainers (including SUSE) should update their libheif packages to v1.22.0 or apply the upstream patch. If an immediate upgrade is not feasible, the most actionable compensating control is to block or sandbox processing of externally sourced HEIF sequence files - for example, stripping HEIF/AVIF attachments at mail or proxy gateways, or running libheif-dependent workloads in a restricted process with limited heap access (e.g., seccomp sandbox, chroot) to contain the impact of a successful out-of-bounds read. Note that blocking all HEIF input may impact legitimate workflows in image pipelines or Apple ecosystem integrations.

More in Libheif

View all

CVE-2023-49464 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit

CVE-2023-49463 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R

CVE-2023-49462 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi

CVE-2023-49460 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom

CVE-2019-11471 HIGH This Week POC

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context

CVE-2024-41311 HIGH This Week POC

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo

CVE-2024-25269 HIGH This Week POC

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne

CVE-2023-29659 MEDIUM This Month POC

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei

CVE-2025-29482 MEDIUM This Month POC

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad

CVE-2026-32740 HIGH This Week

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr

CVE-2026-47178 HIGH This Week

Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-in

CVE-2023-0996 HIGH This Week

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

CVE-2016-5198 HIGH POC

CVE-2025-5777 CRITICAL POC

CVE-2016-1646 HIGH POC

CVE-2017-5030 HIGH POC

CVE-2016-4523 HIGH

CVE-2024-48456 HIGH POC

CVE-2024-48457 HIGH POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected

Share

CVE-2026-41071 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy