Out-of-bounds read in libheif - #VU153983

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service and potentially disclose limited process memory.

The vulnerability exists due to an out-of-bounds read in libsharpyuv gamma table lookups invoked by libheif's sharp-yuv color conversion operator when converting 10-bit or 12-bit RGB images to YCbCr 4:2:0 without validating sample values against the declared bit depth. A remote attacker can trick a victim into processing a crafted image containing out-of-range samples to cause a denial of service and potentially disclose limited process memory.

Only builds with libsharpyuv support enabled through WITH_LIBSHARPYUV are affected. Crafted files can reach the vulnerable conversion through the mixed-interleave unci decoder or the OpenJPEG decoder plugin for JPEG 2000 images with signed components when matrix_coefficients is 0 and full_range_flag is 1.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-q7mw-2fmm-5q94
• https://github.com/strukturag/libheif/commit/8dc32399dea3e6e9e6b4a3acf270feb80008649c

Related Security Bulletins

• Multiple vulnerabilities in libheif