Heap-based buffer overflow in libheif - #VU131968

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in image plane allocation in libheif/pixelimage.cc when processing crafted image data or using the public heif_image_add_plane API. A remote attacker can trigger a uint32_t stride calculation overflow that leads to an undersized heap allocation and subsequent out-of-bounds write to cause a denial of service or potentially execute arbitrary code.

The security limit check validates pixel count rather than stride, and the heif_image_add_plane code path bypasses limits entirely.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-9h96-c44j-jpq9

Related Security Bulletins

• Multiple vulnerabilities in libheif