Out-of-bounds write in libheif - #VU135513

Detailed vulnerability description

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in unc_encoder_rgb_block_pixel_interleave::encode_tile when encoding an RGB image with heif_chroma_interleaved_RRGGBB_LE or heif_chroma_interleaved_RRGGBB_BE and interleaved bit-depth less than or equal to 8. A local user can supply crafted pixel data to trigger a linear heap out-of-bounds write and cause a denial of service or execute arbitrary code.

This issue is not reachable from a crafted input file alone and requires an application to construct an interleaved RRGGBB pixel image with bit-depth less than or equal to 8 from caller-controlled data before encoding with the uncompressed codec.

Remediation

Sources

• https://github.com/strukturag/libheif/security/advisories/GHSA-46rp-pcq2-rpmr