EUVD-2026-83015Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Only reachable via the local writer-API integration with mismatched geometry/mask buffer (AV:L, AC:H); no auth needed (PR:N); partial heap disclosure (C:L) and possible crash (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.
AnalysisAI
Heap out-of-bounds read in libheif prior to 1.23.2 lets an application that builds inline-mask region metadata through the library's writer API leak adjacent heap memory or crash. Specifically, heif_region_item_add_region_inline_mask_data() stored a caller-supplied mask buffer without verifying that mask_data_len equals ceil(width*height/8); a later heif_region_get_mask_image() render derives the number of bytes to read from the region geometry, so an undersized buffer causes the reader to copy bytes past the end of the allocation into the returned monochrome mask image. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an application that constructs region metadata through libheif's WRITER API and calls heif_region_item_add_region_inline_mask_data() with a mask_data_len that does not equal (width*height+7)/8, followed by a heif_region_get_mask_image() render. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-priority memory-safety issue, not a high-CVSS emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: libheif 1.23.2 - upgrade to that version (or later) from https://github.com/strukturag/libheif/releases/tag/v1.23.2, which incorporates commit 646d85fbf5bd18fc3cdc516e915e59072de2d510 and enforces mask_data_len == (width*height+7)/8, rejects null and zero-dimension masks, and adds a bounds check in the reader; the upstream advisory is https://github.com/strukturag/libheif/security/advisories/GHSA-p58j-h3vm-3fp5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
Heap-based buffer overflow in libheif before 1.23.2 allows remote attackers to corrupt memory and potentially achieve co
Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr
Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today