Skip to main content

libheif CVE-2026-49271

| EUVDEUVD-2026-38055 MEDIUM
Out-of-bounds Read (CWE-125)
2026-06-19 GitHub_M
Buffer Overflow Information Disclosure Red Hat Suse Libheif Strukturag
6.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

File delivered over network (AV:N), trivial to craft (AC:L), no attacker privilege needed (PR:N), victim must open file (UI:R), impact is crash only (A:H, C:N, I:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jun 19, 2026 - 19:02 EUVD
Analysis Generated
Jun 19, 2026 - 18:19 vuln.today

DescriptionCVE.org

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.

AnalysisAI

Out-of-bounds heap read in libheif's uncompressed HEIF decoder allows a remote attacker to crash any application processing crafted HEIF files. Versions prior to 1.22.1 fail to safely validate icef compressed-unit offsets because the addition of unit_offset + unit_size can integer-wrap, bypassing the range check and permitting a C++ vector to be constructed from iterators pointing outside the compressed item buffer. Exploitation requires a user or automated pipeline to open an attacker-supplied HEIF file; no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

libheif (CPE: cpe:2.3:a:strukturag:libheif:*:*:*:*:*:*:*:*) is a widely embedded open-source C++ library from strukturag used by image editors, media players, mobile platforms, and transcoding pipelines to parse ISO Base Media File Format-derived HEIF and AVIF containers. The vulnerable code path lies in the uncompressed HEIF decoder, specifically where it validates icef (item content extent fragment) box fields. The decoder computes an inclusive upper bound as unit_offset + unit_size using native unsigned arithmetic; on 32-bit or size_t-constrained builds - or with pathologically large field values - this sum wraps to a small number that falls within apparent bounds, passing the check. The library then constructs a std::vector or similar iterator range anchored to a position beyond the allocated compressed-item buffer, and the subsequent read triggers a heap out-of-bounds access (CWE-125: Out-of-Bounds Read). The tags note 'Information Disclosure' alongside the crash, consistent with OOB reads that may transiently expose adjacent heap contents before the process terminates.

RemediationAI

Upgrade libheif to version 1.22.1, which patches the integer-overflow range check in the uncompressed HEIF decoder (vendor advisory: https://github.com/strukturag/libheif/security/advisories/GHSA-r7qj-cg5r-r6vf). Downstream packages - distribution packages (apt, dnf, brew), embedded copies in media applications, and statically linked builds - must each be independently rebuilt or updated against the patched library; a system libheif upgrade alone does not protect statically linked binaries. If immediate upgrade is not feasible, the most effective compensating control is to disable or block ingestion of HEIF/AVIF files at the application or gateway layer (e.g., reject files with MIME types image/heif, image/heic, image/avif at upload endpoints); this entirely eliminates the attack surface but breaks HEIF/AVIF support. For server-side image processing pipelines, sandboxing the decoding process (e.g., via seccomp or a dedicated low-privilege worker process) limits the blast radius of a crash or potential heap read to the isolated worker rather than the main application. No known workaround eliminates the vulnerability while preserving full HEIF decode functionality.

More in Libheif

View all
CVE-2023-49464 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
CVE-2023-49463 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
CVE-2023-49462 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
CVE-2023-49460 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
CVE-2019-11471 HIGH POC
8.8 Apr 23

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
CVE-2024-41311 HIGH POC
8.1 Oct 15

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
CVE-2024-25269 HIGH POC
7.5 Mar 05

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
CVE-2023-29659 MEDIUM POC
6.5 May 05

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
CVE-2025-29482 MEDIUM POC
6.2 Apr 07

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
CVE-2026-32740 HIGH
8.8 May 19

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr
CVE-2026-47178 HIGH
7.8 Jul 21

Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-in
CVE-2023-0996 HIGH
7.8 Feb 24

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

CVE-2026-49271 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy