libheif CVE-2026-49271

|

EUVD

EUVD-2026-38055 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-19 GitHub_M

Information Disclosure Buffer Overflow Libheif Suse

6.5

CVSS 3.1 · Vendor: GitHub_M

Share

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

File delivered over network (AV:N), trivial to craft (AC:L), no attacker privilege needed (PR:N), victim must open file (UI:R), impact is crash only (A:H, C:N, I:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

2

Patch available

Jun 19, 2026 - 19:02 EUVD

Analysis Generated

Jun 19, 2026 - 18:19 vuln.today

DescriptionCVE.org

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.

AnalysisAI

Out-of-bounds heap read in libheif's uncompressed HEIF decoder allows a remote attacker to crash any application processing crafted HEIF files. Versions prior to 1.22.1 fail to safely validate icef compressed-unit offsets because the addition of unit_offset + unit_size can integer-wrap, bypassing the range check and permitting a C++ vector to be constructed from iterators pointing outside the compressed item buffer. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft HEIF file with integer-wrapping icef offsets

Delivery

Deliver file to target via web upload, email, or link

Exploit

Victim or pipeline invokes libheif decoder

Execution

unit_offset + unit_size wraps, bypasses range check

Persist

Vector constructed from out-of-bounds heap iterators

Impact

Application crash (DoS)

Access

Craft HEIF file with integer-wrapping icef offsets

Delivery

Deliver file to target via web upload, email, or link

Exploit

Victim or pipeline invokes libheif decoder

Execution

unit_offset + unit_size wraps, bypasses range check

Persist

Vector constructed from out-of-bounds heap iterators

Impact

Application crash (DoS)

Sign in to reveal

Vulnerability AssessmentAI

Exploitation	The vulnerable code path is reached only when processing HEIF files that use the uncompressed codec path with icef (item content extent fragment) box data present - not all HEIF files trigger this decoder. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately characterises this as a network-reachable, unauthenticated denial-of-service requiring only that a victim open a crafted file - a common, low-friction precondition in consumer and server image-processing contexts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts or emails a maliciously crafted HEIF image file containing icef box fields engineered to trigger the unit_offset + unit_size integer wrap. When a victim opens the file in any application linked against libheif prior to 1.22.1 - such as an image viewer, a photo management app, or a web service that auto-generates thumbnails - the uncompressed decoder bypasses the range check, constructs an iterator outside the heap buffer, and the application crashes. …
Remediation	Upgrade libheif to version 1.22.1, which patches the integer-overflow range check in the uncompressed HEIF decoder (vendor advisory: https://github.com/strukturag/libheif/security/advisories/GHSA-r7qj-cg5r-r6vf). … Detailed patch versions, workarounds, and compensating controls in full report.

Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libheif

View all

CVE-2023-49464 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit

CVE-2023-49463 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R

CVE-2023-49462 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi

CVE-2023-49460 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom

CVE-2019-11471 HIGH This Week POC

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context

CVE-2024-41311 HIGH This Week POC

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo

CVE-2024-25269 HIGH This Week POC

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne

CVE-2023-29659 MEDIUM This Month POC

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei

CVE-2025-29482 MEDIUM This Month POC

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad

CVE-2026-32740 HIGH This Week

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr

CVE-2023-0996 HIGH This Week

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi

CVE-2026-32741 HIGH This Week

Heap buffer overflow in libheif versions 1.21.2 and below allows remote attackers to corrupt memory via a maliciously cr

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

CVE-2016-5198 HIGH POC

CVE-2016-1646 HIGH POC

CVE-2025-5777 HIGH POC

CVE-2017-5030 HIGH POC

CVE-2016-4523 HIGH

CVE-2024-48456 HIGH POC

CVE-2024-48457 HIGH POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed

Share

CVE-2026-49271 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy