Executive brief
libheif is an open-source library used by many applications to process HEIF and AVIF image files. A security flaw in how the library handles image masks allows a specially crafted image file to crash the application or potentially allow unauthorized code execution. This could lead to service disruptions or a compromise of systems that automatically process user-uploaded images.
Technical details
A heap buffer overflow exists in libheif's MaskImageCodec::decode_mask_image() function within mask_image.cc. The vulnerability occurs when the library processes a HEIF file containing a mask image (mski) item. The function uses memcpy() to copy data from the file's iloc extent into a destination pixel buffer. While the destination buffer is sized based on declared image dimensions (ispe property), the copy length is taken directly from the attacker-controlled iloc extent length without an upper-bound check. An attacker can trigger this by providing a file where the iloc extent exceeds the allocated pixel buffer size, specifically when bits_per_pixel is 8 and the image width is an even value ≥ 64. This results in heap corruption, leading to a denial of service or potential arbitrary code execution. The issue is fixed in version 1.22.0.
Affected products
- strukturag libheif <= 1.21.2
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched: Fixed in version 1.22.0
- 2026-05-19: advisory