EUVD-2025-210287
GHSA-4qq3-gjhp-4grf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Network-delivered malicious image but a user or application must open/preview it, so UI:R; OOB read yields memory disclosure (C:H) and likely crash (A:H) with no integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.
AnalysisAI
Out-of-bounds read in Microsoft HEIF Image Extensions 1.2.22.0 allows remote attackers to disclose memory contents and crash the process by serving a crafted HEIF image. The flaw stems from CHEIFItemInfoEntry_GetDataSize returning success with a reported data size of zero, leading to a 1-byte allocation that is later overrun by a memmove in CopyPixels. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Technical ContextAI
Microsoft HEIF Image Extensions is a Windows component (shipped via the Microsoft Store) that adds support for the High Efficiency Image File Format (HEIF/HEIC) to apps such as Photos, File Explorer thumbnails, and any application using the Windows Imaging Component. The bug is a classic CWE-125 Out-of-bounds Read: CHEIFItemInfoEntry_GetDataSize signals success while the size-out parameter remains zero, so the caller allocates a 1-byte destination buffer; CopyPixels then computes copy_size = stride * abs(roi_height) and issues a memmove without validating the source buffer length, reading past the small allocation and into adjacent memory. Because parsing is triggered automatically by the OS shell and many apps whenever a HEIF/HEIC file is rendered, the attack surface extends well beyond an explicitly opened image. The CPE entry is generic ('a:n/a:n/a'), so exact product mapping must be derived from the description rather than NVD CPE data.
RemediationAI
No vendor-released patch identified at time of analysis; Microsoft has not published an advisory or fixed build in the supplied data. As a compensating control, update Microsoft HEIF Image Extensions to the latest version available in the Microsoft Store (Settings → Apps → Installed apps → HEIF Image Extensions → Advanced options, or via 'Get updates' in the Store) since Store apps auto-patch out-of-band from Patch Tuesday - this is the most likely delivery channel once a fix ships. Until a confirmed fixed version is published, reduce exposure by uninstalling the HEIF Image Extensions package on systems that do not need HEIC support (trade-off: HEIC/HEIF images, including iPhone-sourced photos, will no longer render in Windows apps), blocking inbound HEIC/HEIF attachments at the mail and web proxy, and disabling automatic thumbnail generation for HEIF files in Explorer to avoid passive parsing. Monitor https://nvd.nist.gov/vuln/detail/CVE-2025-62821 and the researcher's tracker at https://github.com/hyunjungg/CVE-2025-62821 for patch confirmation.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today