Out-of-bounds read in libheif - #VU146735

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in Op_RGB_to_YCbCr::convert_colorspace in libheif/color-conversion/rgb2yuv.cc when converting a planar RGB image to YCbCr through the identity matrix path with mismatched per-channel bit depths. A remote attacker can supply a specially crafted image to disclose sensitive information or cause a denial of service.

Exploitation requires matrix_coefficients set to 0 with full_range enabled and the non-default decoding option output_image_nclx_profile_passthrough enabled. Default decoding and the heif-dec tool do not reach the vulnerable path.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-9rj8-5mp5-26c9
• https://github.com/strukturag/libheif/commit/6ee1419f

Related Security Bulletins

• Multiple vulnerabilities in libheif