Out-of-bounds read in libheif - #VU135514

Detailed vulnerability description

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the uncompressed RRGGBB encoder path when encoding an RGB image with heif_chroma_interleaved_RRGGBB_LE or heif_chroma_interleaved_RRGGBB_BE and interleaved bit-depth less than or equal to 8. A local user can supply a crafted source plane that is read as 16-bit samples despite containing less than or equal to 8-bit interleaved data to disclose sensitive information or cause a denial of service.

This issue occurs in the same encoding path as the write overflow and requires an application to provide a self-inconsistent interleaved RRGGBB image configuration to the uncompressed codec.

Remediation

Sources

• https://github.com/strukturag/libheif/security/advisories/GHSA-46rp-pcq2-rpmr