Executive brief
libheif is a widely used software library for processing HEIF and AVIF image files, commonly found in image viewers, web servers, and photo editing tools. A security flaw allows a specially crafted image file to cause a memory error when opened, potentially leading to a program crash or allowing an attacker to take control of the application. This could impact services that automatically process user-uploaded images, such as social media platforms or cloud storage providers.
Technical details
A heap out-of-bounds write exists in libheif's uncompressed 'unci' codec subsystem, specifically within the unc_decoder_component_interleave::decode_tile() function. The vulnerability is caused by an incorrect row offset calculation where full-resolution tile origins are used against halved chroma plane strides in 4:2:0 interleaved images. An attacker can exploit this by providing a crafted HEIF file that overwrites the C++ vtable pointer of an adjacent object. This allows for a controlled indirect call, potentially leading to arbitrary code execution when the next virtual function is dispatched. The issue is fixed in version 1.22.0.
Affected products
- strukturag libheif 1.19.0 - 1.21.2
Timeline
- 2026-05-19: disclosed: Initial disclosure on GitHub
- 2026-07-21: advisory: NVD publication date