Access of Uninitialized Pointer in libheif - #VU158743
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service and, under restricted conditions, expose attacker-selected memory or trigger an invalid free.
The vulnerability exists due to access of an uninitialized pointer in the libheif gdk-pixbuf loader's stop_load() function when image scaling fails and its return value is ignored. A remote attacker can trick a victim into loading a crafted HEIF/AVIF file at a fixed width or height while preserving its aspect ratio, causing an oversized scaling allocation to fail and the loader to read through and subsequently free an uninitialized image pointer.
Memory exposure and invalid-free effects were demonstrated only with address randomization disabled; with ASLR enabled, only an application crash was demonstrated.