Executive brief
libheif is a widely used software library for processing HEIF and AVIF image files. A vulnerability in how the library handles malformed image sequences allows an attacker to crash applications that use this library by providing a specially crafted image file. This could lead to a denial-of-service (DoS) condition, affecting the availability of services that process user-uploaded images.
Technical details
An out-of-bounds read and subsequent NULL pointer dereference exists in the SampleAuxInfoReader constructor within libheif/sequences/track.cc. The vulnerability is triggered when a malformed HEIF file contains a specific combination of metadata: a zero entry count in the Sample to Chunk Box (stco) and Sample Auxiliary Information Offsets Box (saio), but a non-zero sample count in the Sample Auxiliary Information Sizes Box (saiz). This configuration causes the parser to enter a loop and attempt to access an empty 'chunks' vector at index 0. An attacker can exploit this by providing a crafted HEIF/AVIF file to any application using the libheif public API (e.g., heif_context_read_from_file). The issue is fixed in version 1.22.0.
Affected products
- strukturag libheif <= 1.21.2
Timeline
- 2026-05-19: patched: Fixed in version 1.22.0
- 2026-05-22: disclosed: CVE-2026-41069 published