SB20261111134 - Gentoo update for libheif

Description

This security bulletin contains information about 28 vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2026-47709)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in heif_image_handle_get_image_tiling() when processing a malformed uncompressed HEIF image item missing the ispe property. A remote attacker can supply a specially crafted HEIF file to cause a denial of service.

The issue is reachable through the public C API and may trigger an assertion in debug builds.

2) Out-of-bounds read (CVE-ID: CVE-2026-84451)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in unc_decoder::get_compressed_image_data_uncompressed() when decoding an advertised uncompressed image tile from a crafted HEIF file through the public tile API. A remote attacker can provide a crafted HEIF file to cause a denial of service.

User interaction is required to open or process a crafted HEIF file, and the demonstrated trigger requires decoding a high-index advertised tile through heif_image_handle_decode_image_tile().

3) Reachable assertion (CVE-ID: CVE-2026-84450)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reachable assertion in Fraction::Fraction and Box_clap clap geometry helpers when parsing a crafted AVIF image with a clap property and oversized ispe dimensions. A remote attacker can supply a specially crafted image file to cause a denial of service.

The issue is triggered in assert-enabled builds via the public C API during heif_image_handle_get_image_tiling(), and user interaction is required to open or process the crafted image.

4) Out-of-bounds read (CVE-ID: CVE-2026-84448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in heif_region_get_inline_mask_image() and the inline-mask region writer API when processing caller-supplied inline mask geometry and buffer lengths. A remote attacker can supply an undersized mask buffer with crafted width and height values to disclose sensitive information and cause a denial of service.

The issue is confined to the public writer API and is not reachable through the file-parsing path.

5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-84447)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the derived image decode paths when processing crafted grid or overlay images with indirect iden reference chains. A remote attacker can send a specially crafted HEIF or AVIF file to cause a denial of service.

For grid images, triggering the issue requires the consumer to request decoding of the grid image.

6) Infinite loop (CVE-ID: CVE-2026-84446)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the HEIF sequence decode timing-table initialization and sequence decode path when processing a crafted HEIF sequence file. A remote attacker can supply a crafted file with an amplified logical output sample count to cause a denial of service.

The issue can bypass the max_sequence_frames limit because the logical output sample count is not constrained after repeat amplification.

7) Out-of-bounds write (CVE-ID: CVE-2026-84444)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to out-of-bounds write in heif_context_add_image_tile() when encoding an ISO/IEC 23001-17 uncompressed tiled image with inconsistent component plane sizes. A remote attacker can supply a specially crafted heif_image tile with component planes larger than its declared dimensions to cause memory corruption.

Only builds with the experimental uncompressed codec enabled are affected.

8) Improper handling of highly compressed data (CVE-ID: CVE-2026-84384)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in brotli and zlib decompression paths when parsing a crafted HEIF or AVIF file. A remote attacker can supply a decompression bomb to cause a denial of service.

The issue can be triggered during file open, and some variants require the uncompressed codec feature to be enabled.

9) Heap-based buffer overflow (CVE-ID: CVE-2026-84383)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in HeifPixelImage::scale_nearest_neighbor() when parsing a crafted HEIC, HEIF, or AVIF file with nested iden and auxl item references that create duplicate Alpha planes. A remote attacker can supply a specially crafted file to execute arbitrary code.

Any application using heif_decode_image() is affected, and no special API options or unusual calling patterns are required.

10) Out-of-bounds read (CVE-ID: CVE-2026-62292)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in unc_decoder::get_compressed_image_data_uncompressed() when decoding an advertised image tile from a crafted HEIF uncompressed image through heif_image_handle_decode_image_tile(). A remote attacker can supply a specially crafted HEIF file and trigger tile decoding to cause a denial of service.

The issue is not triggered by merely opening the file; the vulnerable path is reached when an application enumerates tiling metadata and decodes an advertised tile.

11) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-50142)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Box_stsz::parse() fixed-size mode when parsing a crafted HEIF sequence file through the public C API. A remote attacker can supply a crafted HEIF sequence file with an excessive sample_count value to cause a denial of service.

Only the file parser is exercised, and no decoder backend is required.

12) Out-of-bounds read (CVE-ID: CVE-2026-49271)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in unc_decoder::get_compressed_image_data_uncompressed when parsing a crafted HEIF file with wrapped icef compressed-unit offsets and sizes. A remote attacker can supply a specially crafted HEIF file to cause a denial of service.

The issue is reached when the cmpC compressed unit type is not image_tile, and user interaction is required to decode the crafted media.

13) Out-of-bounds read (CVE-ID: CVE-2026-48029)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ImageItem_Grid::decode_grid_tile when parsing a crafted HEIF/HEIC file containing a grid-derived item with an irot rotation property. A remote attacker can send a specially crafted file to cause a denial of service and disclose sensitive information.

User interaction is required to open or decode the crafted file.

14) Integer overflow (CVE-ID: CVE-2026-47714)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to integer overflow or wraparound in the inline mask parsing code in libheif/region.cc when parsing a crafted HEIF file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and disclose sensitive information.

The issue is reachable when applications raise the max_image_size_pixels limit or disable it via LIBHEIF_SECURITY_LIMITS=off.

15) Buffer overflow (CVE-ID: CVE-2023-0996)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing ISO/IEC 23008-12:2017 HEIF and AVIF files. A remote attacker can trick the victim into opening a specially crafted image file, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

16) Out-of-bounds read (CVE-ID: CVE-2026-47254)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Track::get_next_sample_raw_data() when parsing a crafted HEIC sequence file and retrieving raw sequence samples. A remote attacker can supply a specially crafted file to cause a denial of service or disclose sensitive information.

The issue is triggered when the number of chunks defined in the stco box is less than the number of samples in stsz, causing an invalid chunk index to be stored in the presentation timeline.

17) Out-of-bounds read (CVE-ID: CVE-2026-47251)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to out-of-bounds read in vvdec_push_data2 in libheif's VVC decoder plugin when parsing a crafted HEIF file with a VVC track. A remote attacker can supply a specially crafted HEIF file to cause a denial of service and disclose sensitive information.

User interaction is required to open or decode the crafted file. Only builds with VVC support enabled are vulnerable.

18) Use of uninitialized resource (CVE-ID: CVE-2026-47247)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource and incorrect calculation in libheif grid image decoding when parsing a crafted AVIF or HEIC grid image. A remote attacker can upload a specially crafted image for decoding and obtain heap memory contents from visible pixels in the decoded output to disclose sensitive information.

The leaked data may include heap contents such as library function pointers that can be used to defeat ASLR, and the issue is exposed when decoded output is made available to the attacker.

19) Out-of-bounds write (CVE-ID: CVE-2026-47178)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in unc_decoder_component_interleave::decode_tile() when parsing a crafted HEIF file using the uncompressed unci codec with tiled, component-interleaved 4:2:0 content. A remote attacker can supply a specially crafted HEIF file to execute arbitrary code.

Only instances built with WITH_UNCOMPRESSED_CODEC=ON are vulnerable.

20) Out-of-bounds read (CVE-ID: CVE-2026-41071)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in SampleAuxInfoReader::SampleAuxInfoReader() in libheif/sequences/track.cc when parsing a crafted HEIF sequence file with a mismatched saiz sample count. A remote attacker can supply a specially crafted HEIF file to disclose sensitive information or cause a denial of service.

The issue is triggered during file parsing via heif_context_read_from_file without additional user interaction, and in debug builds an assertion may fire instead of the out-of-bounds access.

21) Out-of-bounds read (CVE-ID: CVE-2026-41069)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in SampleAuxInfoReader::SampleAuxInfoReader in libheif/sequences/track.cc when parsing a malformed HEIF sequence file through heif_context_read_from_file. A remote attacker can supply a specially crafted file to cause a denial of service.

User interaction is required to open or process a crafted HEIF file.

22) Out-of-bounds read (CVE-ID: CVE-2026-32882)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read in HeifPixelImage::overlay() when parsing a crafted HEIF file containing an overlay image whose child image uses a different alpha-channel bit depth than the color channels. A remote attacker can supply a specially crafted HEIF file to cause a denial of service or disclose sensitive information.

User interaction is required to open or otherwise process the crafted file.

23) Use of uninitialized resource (CVE-ID: CVE-2026-32814)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in ImageItem_Grid::decode_and_paste_tile_image() in libheif/image-items/grid.cc when decoding a crafted HEIF or AVIF grid image with strict_decoding=false. A remote attacker can supply a specially crafted file with a corrupted tile to disclose sensitive information.

User interaction is required to process the crafted file, and the issue occurs with the default decoding behavior where tile decode failures are returned as success.

24) Heap-based buffer overflow (CVE-ID: CVE-2026-32741)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in MaskImageCodec::decode_mask_image() in libheif/image-items/mask_image.cc when parsing a crafted HEIF file containing a mask image. A remote attacker can supply a specially crafted HEIF file with an oversized iloc extent to cause a denial of service and potentially execute arbitrary code.

User interaction is required to open or process the crafted HEIF file. Exploitation requires an mski item with mskC bits_per_pixel set to 8 and image properties that enter the single-memcpy branch where stride equals width.

25) Out-of-bounds write (CVE-ID: CVE-2026-32740)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in HeifPixelImage::copy_image_to() when decoding a crafted grid-based HEIF or AVIF image. A remote attacker can supply a specially crafted file to execute arbitrary code.

User interaction is required to open or decode a crafted file. Exploitation requires grid images using YCbCr 4:2:0 chroma subsampling with odd-height tiles.

26) Infinite loop (CVE-ID: CVE-2026-32739)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to loop with unreachable exit condition in Box_stts::get_sample_duration() when parsing a crafted HEIF sequence file during file open. A remote attacker can send a specially crafted file to cause a denial of service.

User interaction is required to open the crafted file.

27) Out-of-bounds read (CVE-ID: CVE-2026-32738)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in Chunk::get_data_extent_for_sample() when parsing a crafted HEIF sequence file with samples_per_chunk set to 0 in the stsc box. A remote attacker can supply a specially crafted file to cause a denial of service.

User interaction is required to open the crafted file and access the first frame or sample.

28) Division by zero (CVE-ID: CVE-2023-29659)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a floating point exception within the heif::Fraction::round() function in box.cc. A remote attacker can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/glsa/202611-04