Executive brief
Microsoft HEIF Image Extensions is a system component used by Windows to display and process HEIF-formatted images. A vulnerability in this component allows a specially crafted image file to cause applications to crash when they attempt to open or preview the file. This results in a denial-of-service condition for any software that relies on the Windows imaging framework to handle these files, such as File Explorer or photo viewing apps.
Technical details
An out-of-bounds read exists in the msheif_store.dll module of Microsoft HEIF Image Extensions version 1.2.22.0. The vulnerability is triggered when CHEIFItemInfoEntry_GetDataSize returns a success code but reports a data size of 0, leading CHEIFStreamReader_ReadItemData to call MFCreateMemoryBuffer with a zero-length request, resulting in a 1-byte allocation. Subsequently, the CopyPixels function (specifically within sub_7FFD8411FC40) calculates a large copy size based on image geometry (stride * height) and executes a memmove without validating that the source buffer is large enough. An attacker can exploit this by providing a crafted HEIF image, causing a vectorized load instruction to read past the 1-byte buffer, resulting in an access violation (c0000005) and application crash.
Affected products
- Microsoft HEIF Image Extensions 1.2.22.0
Timeline
- 2026-06-19: disclosed: Vulnerability details and PoC published on GitHub.
- 2026-06-19: advisory: CVE-2025-62821 published.