Heap-based buffer overflow in libheif - #VU158754

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by triggering heap corruption and a process crash.

The vulnerability exists due to a heap-based buffer overflow in libheif's HeifPixelImage::extend_padding_to_size() when a requested padding size increases one dimension but decreases the other. The function allocates a plane using the requested dimensions but copies the original plane's full rows, writing beyond the allocation. A remote attacker can supply a crafted mixed-size image sequence to an application that re-encodes its frames using the x265 HEVC or x264 AVC sequence encoder to cause a denial of service.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-hpg4-g2gc-pq42
• https://github.com/strukturag/libheif/commit/9ec655f76b6fe298092aaeb063f821f53b8eb901

Related Security Bulletins

• Multiple vulnerabilities in libheif