Improper Validation of Specified Quantity in Input in libheif - #VU153981

Vulnerability details

The vulnerability allows a remote attacker to cause decoded chroma samples to exceed their declared bit depth.

The vulnerability exists due to improper validation of sample bit widths in unc_decoder_mixed_interleave::processTile() when decoding uncompressed images in mixed interleave mode. A remote attacker can supply a crafted image containing additional sample or alignment padding bits to cause decoded chroma samples to exceed their declared bit depth.

The uncompressed codec must be enabled through WITH_UNCOMPRESSED_CODEC, which is disabled by default. Chroma bit depths other than 8 and 16 are affected. User interaction is required. Excess values reach callers when color conversion is not applied, or survive conversion to RGB when matrix_coefficients is 0 with full range. This issue alone does not cause out-of-bounds memory access within libheif.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-v5rj-g4wv-j5w3
• https://github.com/strukturag/libheif/commit/6e7c728f3015fc02bea9a30a42e6834bee71c752

Related Security Bulletins

• Multiple vulnerabilities in libheif