Out-of-bounds read in libheif - #VU146732
Published: September 2, 2026
Vulnerability identifier: #VU146732
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an assert-based error handling flaw leading to an out-of-bounds read in loadPNG when processing a PNG file with corrupted IDAT data in NDEBUG builds. A remote attacker can send a specially crafted PNG file to disclose sensitive information.
Only NDEBUG builds are affected, and the leaked heap data is written into the generated HEIF output while the operation may still report success.
Affected software
libheif
Remediation
Install security update from vendor's website.
libheif - update to 1.23.3