Executive brief
Android's HEIF image processing component contains an integer overflow vulnerability in HeifCleanAperture.cpp that can be triggered by a specially crafted image file. An attacker can cause a temporary denial of service (app crash or system freeze) by sending or hosting a malicious image, requiring no user privileges and potentially no user interaction on affected devices. This impacts availability of Android devices and applications that process HEIF images.
Technical details
A remote integer overflow vulnerability exists in the convertCleanApertureToRect function of HeifCleanAperture.cpp in the Android framework's HEIF image parser. The vulnerability is triggered when processing specially crafted HEIF images with malicious clean aperture metadata, leading to integer arithmetic overflow. Attack vector is network-based; a remote attacker can exploit this by sending or hosting a malicious HEIF image file. No authentication or user interaction is required for exploitation. Successful exploitation results in a temporary denial of service (crash of the parsing component or affected application). Patches are available in Android security updates dated 2026-09-05 and later across affected AOSP versions.
Affected products
- Google Android 14 and later
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched