Out-of-bounds read in libheif - #VU158755

Vulnerability details

The vulnerability allows a remote attacker to disclose process memory through decoded images or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in libheif's OpenH264 decoding path when processing an AVC-coded HEIF file containing an SPS that the coded-size scanner cannot parse. A remote attacker can supply a specially crafted file with cropping offsets that overflow a signed 32-bit check, causing rejected SPS data to reach OpenH264 and the plugin to copy from image-plane pointers outside the decoded frame buffer, to disclose process memory or crash the application.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-xwcv-cp39-m2w4
• https://github.com/strukturag/libheif/commit/2a407685a835186f3028119e2e4a4c8e30356bf6

Related Security Bulletins

• Multiple vulnerabilities in libheif