EUVD-2026-83025Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Dimensions are supplied through the local encoder API rather than a parsed file, so AV:L/PR:L; the huge-image precondition keeps AC:H, and impact is a crash only (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.
AnalysisAI
An integer-overflow flaw in libheif's RGB-to-YCbCr conversion path (libheif/color-conversion/rgb2yuv.cc) can crash an application that encodes extremely large RGB images constructed via heif_image_create() and heif_image_add_plane() before calling heif_context_encode_image(); a 32-bit stride field wraps, so the conversion loop computes an invalid input pointer and reads past the end of the allocated interleaved plane. Affected deployments are those running libheif versions prior to 1.19.6 that expose the ENCODE path to caller- or attacker-influenced image dimensions - pure decode/parsing workflows are not affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the application to use libheif's ENCODE path - specifically constructing an image via heif_image_create() and heif_image_add_plane() with extremely large RGB dimensions, then invoking heif_context_encode_image() to perform RGB-to-YCbCr conversion in libheif/color-conversion/rgb2yuv.cc. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 1.19.6 - upgrade to libheif 1.19.6 (https://github.com/strukturag/libheif/releases/tag/v1.19.6) using the guidance in advisory GHSA-2c3g-p585-8rpq; note that commit e29953da30eb11aa1762df0bff3b36be4b22fbe3 changes public API signatures from uint32_t* to size_t* for the plane and channel stride out-parameters, so dependent applications must be recompiled against the new headers rather than simply relinked with the updated shared library, or they may silently misread stride values and corrupt memory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
Heap-based buffer overflow in libheif before 1.23.2 allows remote attackers to corrupt memory and potentially achieve co
Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr
Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-in
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today