SB2026090248 - Multiple vulnerabilities in libheif

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090248

SB2026090248 - Multiple vulnerabilities in libheif

Published: September 2, 2026

Security Bulletin ID SB2026090248
CSH Severity
High
Patch available
YES
Number of vulnerabilities 14
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 7% Medium 64% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 14 vulnerabilities.


1) Deadlock (CVE-ID: N/A)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to deadlock in ImageItem::decode_image when parsing a crafted file with cyclic auxiliary alpha references. A remote attacker can supply a specially crafted file to cause a denial of service.

The issue is reachable in a default build with default security limits, and a single decode thread can hang permanently.


2) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Op_YCbCr420_to_RRGGBBaa::convert_colorspace when decoding a crafted unci YCbCr 4:2:0 image to RGB output through the public API. A remote attacker can supply a crafted image with a 16-bit Y channel and 8-bit Cb/Cr channels to disclose sensitive information.

Only builds with the uncompressed codec enabled are vulnerable, and the disclosed heap bytes are written into the decoded RGB output.


3) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Op_YCbCr420_to_RGB24::convert_colorspace() when decoding an uncompressed HEIF sequence with an odd-height YCbCr 4:2:0 frame through the public sequence decoding API while requesting RGB output. A remote attacker can supply a specially crafted HEIF sequence file to disclose sensitive information.

User interaction is required to process the crafted file, and the issue is reachable only when the uncompressed codec is enabled.


4) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in the built-in `unci` mixed-interleave decoder when parsing a crafted uncompressed-image file with unequal chroma bit depths. A remote attacker can supply a specially crafted HEIF image to execute arbitrary code.

Only builds with `WITH_UNCOMPRESSED_CODEC=ON` are vulnerable. The issue is internal to libheif's `unci` decoder and does not require external codecs. The demonstrated code-execution and file-disclosure impacts were build- and deployment-specific rather than universal.


5) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reachable assertion in Fraction::Fraction and Box_clap clap geometry helpers when parsing a crafted AVIF image with a clap property and oversized ispe dimensions. A remote attacker can supply a specially crafted image file to cause a denial of service.

The issue is triggered in assert-enabled builds via the public C API during heif_image_handle_get_image_tiling(), and user interaction is required to open or process the crafted image.


6) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in heif_image_handle_get_depth_image_handle and heif_image_handle_get_depth_image_representation_info when processing a HEIF or AVIF file without a depth auxiliary image. A remote attacker can supply a file that lacks a depth auxiliary image to cause a denial of service.

Exploitation requires an application to call the depth API without first checking has_depth_image().


7) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in ExifTags::Parse in the TIFF decoder when parsing a crafted TIFF file with an EXIF tag length value that lacks an upper bound. A remote attacker can send a specially crafted TIFF file to cause a denial of service.

The malicious EXIF tag is parsed after the image decodes successfully, and multiple oversized tag lengths can accumulate memory consumption.


8) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an assert-based error handling flaw leading to an out-of-bounds read in loadPNG when processing a PNG file with corrupted IDAT data in NDEBUG builds. A remote attacker can send a specially crafted PNG file to disclose sensitive information.

Only NDEBUG builds are affected, and the leaked heap data is written into the generated HEIF output while the operation may still report success.


9) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in GetPlane in the Go language binding when processing a large HEIF image and calculating stride multiplied by height with a 32-bit integer. A remote attacker can upload a specially crafted HEIF file to cause a denial of service.

The issue occurs because the binding uses the deprecated heif_image_get_plane() API instead of heif_image_get_plane2().


10) Improper Handling of Length Parameter Inconsistency (CVE-ID: N/A)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a buffer size mismatch causing an out-of-bounds read in SDL_YUV_Display::display420 and heif_view when displaying a crafted HEIF sequence whose declared track resolution is larger than the decoded frame dimensions. A remote attacker can trick the victim into opening a crafted HEIF file to disclose sensitive information.

The example viewer initializes the SDL texture from attacker-controlled VisualSampleEntry dimensions and does not verify that decoded frame dimensions match them.


11) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in Op_RGB_to_YCbCr::convert_colorspace in libheif/color-conversion/rgb2yuv.cc when converting a planar RGB image to YCbCr through the identity matrix path with mismatched per-channel bit depths. A remote attacker can supply a specially crafted image to disclose sensitive information or cause a denial of service.

Exploitation requires matrix_coefficients set to 0 with full_range enabled and the non-default decoding option output_image_nclx_profile_passthrough enabled. Default decoding and the heif-dec tool do not reach the vulnerable path.


12) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in svt_encode_sequence_frame() in the SVT-AV1 encoder plugin when encoding an image with an alpha channel at a bit depth greater than 8. A remote attacker can supply a specially crafted image for transcoding to cause a denial of service.

Only builds with the SVT-AV1 encoder plugin enabled are vulnerable, and the issue is triggered on the high-bit-depth alpha-channel code path.


13) Reliance on undefined behavior (CVE-ID: N/A)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reliance on undefined behavior in the Op_to_hdr_planes logic in libheif/color-conversion/hdr_sdr.cc when converting color planes with output bit depths greater than 16. A remote attacker can trigger color conversion with a crafted output bit depth to cause a denial of service.

The issue occurs because a negative shift exponent can be reached during processing, such as when 8-bit input is converted to 20-bit, 24-bit, or 32-bit output.


14) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in unc_decoder::get_compressed_image_data_uncompressed() when decoding an advertised uncompressed image tile from a crafted HEIF file through the public tile API. A remote attacker can provide a crafted HEIF file to cause a denial of service.

User interaction is required to open or process a crafted HEIF file, and the demonstrated trigger requires decoding a high-index advertised tile through heif_image_handle_decode_image_tile().


Remediation

Install update from vendor's website.

References