Executive brief
libheif is a software library used to process HEIF and AVIF images, commonly used by websites and applications to handle user-uploaded photos. A vulnerability exists where a specially crafted image can cause the library to fail silently during processing and instead return raw, uninitialized memory from the server's heap as if it were part of the image. If an application re-processes this image (for example, creating a thumbnail), it may inadvertently leak sensitive internal data—such as authentication tokens, database results, or other users' information—back to the attacker.
Technical details
A vulnerability in libheif versions 1.21.2 and prior allows for an uninitialized heap memory information leak when decoding HEIF grid images. The issue stems from two combined flaws: first, the library's canvas allocation for Y, Cb, and Cr planes does not zero-initialize memory; second, when 'strict_decoding' is set to false (the default), the library silently ignores tile decoding failures and returns 'heif_error_Ok'. An attacker can provide a crafted .heic or .avif file with a corrupted tile, causing the library to return uninitialized heap data (approximately 12KB per failed tile) as decoded pixel values. If the calling application subsequently encodes or displays this image, the leaked heap contents—potentially containing sensitive data from other processes—are exposed. This has been patched in version 1.22.0.
Affected products
- strukturag libheif <= 1.21.2
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-05-19: patched: Fixed in version 1.22.0