Out-of-bounds read in libheif - #VU135516

Detailed vulnerability description

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in unc_decoder::get_compressed_image_data_uncompressed() when decoding an advertised image tile from a crafted HEIF uncompressed image through heif_image_handle_decode_image_tile(). A remote attacker can supply a specially crafted HEIF file and trigger tile decoding to cause a denial of service.

The issue is not triggered by merely opening the file; the vulnerable path is reached when an application enumerates tiling metadata and decodes an advertised tile.

Remediation

Sources

• https://github.com/strukturag/libheif/security/advisories/GHSA-73p7-m7gg-w2jv
• https://github.com/strukturag/libheif/commit/3021ff4efd897f9d66fd6287dad33e138de27dd4