Integer overflow in libheif - #VU131960
Published: May 20, 2026
Vulnerability identifier: #VU131960
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: struktur AG
Affected software:
libheif
libheif
Detailed vulnerability description
The vulnerability allows a remote attacker to cause incorrect association of auxiliary metadata with decoded samples.
The vulnerability exists due to integer overflow in SampleAuxInfoReader::get_sample_info() in libheif/sequences/track.cc when processing a crafted HEIF sequence file with a large number of samples. A remote attacker can supply a specially crafted sequence file to cause incorrect association of auxiliary metadata with decoded samples.
The resulting wrapped offset causes auxiliary data to be read from an unintended file position, and user interaction is required to open or process the crafted file.
Remediation
Install security update from vendor's website.