SB2026082574 - Multiple vulnerabilities in libheif

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082574

SB2026082574 - Multiple vulnerabilities in libheif

Published: August 25, 2026

Security Bulletin ID SB2026082574
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 63% Low 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the derived image decode paths when processing crafted grid or overlay images with indirect iden reference chains. A remote attacker can send a specially crafted HEIF or AVIF file to cause a denial of service.

For grid images, triggering the issue requires the consumer to request decoding of the grid image.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in TiledHeader::set_parameters() when opening a crafted experimental tiled image. A remote attacker can send a specially crafted HEIF or AVIF file to cause a denial of service.

Only builds with the experimental tili feature enabled are vulnerable, and the allocation is triggered at file-open time.


3) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the HEIF sequence decode timing-table initialization and sequence decode path when processing a crafted HEIF sequence file. A remote attacker can supply a crafted file with an amplified logical output sample count to cause a denial of service.

The issue can bypass the max_sequence_frames limit because the logical output sample count is not constrained after repeat amplification.


4) Improper handling of highly compressed data (CVE-ID: N/A)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in brotli and zlib decompression paths when parsing a crafted HEIF or AVIF file. A remote attacker can supply a decompression bomb to cause a denial of service.

The issue can be triggered during file open, and some variants require the uncompressed codec feature to be enabled.


5) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in HeifPixelImage::scale_nearest_neighbor() when parsing a crafted HEIC, HEIF, or AVIF file with nested iden and auxl item references that create duplicate Alpha planes. A remote attacker can supply a specially crafted file to execute arbitrary code.

Any application using heif_decode_image() is affected, and no special API options or unusual calling patterns are required.


6) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in derived-item and pixel-plane handling when parsing a malformed HEIC image file. A remote attacker can supply a specially crafted HEIC image file to execute arbitrary code.

The issue stems from incorrect assumptions about HeifPixelImage logical geometry and channel plane backing, which can be violated through derived items and auxiliary chains.


7) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to out-of-bounds write in heif_context_add_image_tile() when encoding an ISO/IEC 23001-17 uncompressed tiled image with inconsistent component plane sizes. A remote attacker can supply a specially crafted heif_image tile with component planes larger than its declared dimensions to cause memory corruption.

Only builds with the experimental uncompressed codec enabled are affected.


8) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in heif_region_get_inline_mask_image() and the inline-mask region writer API when processing caller-supplied inline mask geometry and buffer lengths. A remote attacker can supply an undersized mask buffer with crafted width and height values to disclose sensitive information and cause a denial of service.

The issue is confined to the public writer API and is not reachable through the file-parsing path.


Remediation

Install update from vendor's website.

References