libheif EUVD-2026-30981

Exploitation requires the victim to open or process a crafted HEIF file with libheif ≤ 1.21.2, and the malicious file must include an overlay item (iovl box) whose referenced child image has a different bit depth for the alpha channel than for the color channels (e.g., 10-bit color with 8-bit alpha) - files without this bit-depth mismatch or without an iovl construction do not trigger the bug. Per the CVSS vector, attack is network-deliverable and unauthenticated but requires user interaction (UI:R), so it is gated on a user, automated thumbnailer, or server-side image pipeline actually invoking the libheif overlay code path on the attacker-supplied file. Heap-disclosure value is further limited to deployments that return the decoded image back to the attacker.

CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) reflects a network-reachable, unauthenticated bug that requires user interaction (opening a malicious HEIF file) with high availability impact and low confidentiality impact - consistent with the heap over-read description. No EPSS score, no KEV listing, and no public exploit identified at time of analysis, so this is not currently a mass-exploited issue, but the attack surface is broad because HEIF parsing is silently invoked by file managers, thumbnailers, browsers (iOS/Safari, Chrome via AVIF), and media frameworks that bundle libheif. The realistic risk is moderate: crash-level DoS in client apps is reliable, while heap disclosure is opportunistic and depends on allocator layout. SSVC inputs (exploitation status, automatable, technical impact) were not supplied - treat the prioritization above as inferred from CVSS and tags only.

An attacker emails or hosts a malicious HEIF file containing an iovl-referenced overlay image where the color channels use 10-bit depth and the alpha channel uses 8-bit depth; when a victim previews the image in a file manager, mail client, or web app that uses libheif, HeifPixelImage::overlay() over-reads the alpha plane and either crashes the host process (DoS) or embeds adjacent heap bytes into the decoded output. If the rendered image is returned to the attacker (e.g., via a service that re-encodes uploaded HEIFs), the leaked bytes can be exfiltrated to disclose secrets co-located on the heap. No public exploit identified at time of analysis.