Out-of-bounds read in libheif - #VU146726
Published: September 2, 2026
Vulnerability identifier: #VU146726
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in Op_YCbCr420_to_RRGGBBaa::convert_colorspace when decoding a crafted unci YCbCr 4:2:0 image to RGB output through the public API. A remote attacker can supply a crafted image with a 16-bit Y channel and 8-bit Cb/Cr channels to disclose sensitive information.
Only builds with the uncompressed codec enabled are vulnerable, and the disclosed heap bytes are written into the decoded RGB output.
Affected software
libheif
Remediation
Install security update from vendor's website.
libheif - update to 1.23.3