SB2026082530 - Out-of-bounds read in libheif

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082530

SB2026082530 - Out-of-bounds read in libheif

Published: August 25, 2026

Security Bulletin ID SB2026082530
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the YCbCr to RGB color conversion code in libheif when parsing a crafted HEIF file containing an uncompressed YCbCr planar image with an odd component bit depth and decoding it to RGB. A remote attacker can supply a specially crafted HEIF file to cause a denial of service and disclose sensitive information.

User interaction is required to open the crafted file, or the vulnerable application must process it automatically.


Remediation

Install update from vendor's website.

References