Executive brief
libheif is an open-source library used to decode and encode HEIF and AVIF image files, commonly used in photo viewing and editing software. A vulnerability in how the library handles malformed image sequences could allow an attacker to crash an application or potentially access sensitive information from the computer's memory. To exploit this, an attacker would need to trick a user into opening a specially crafted image file.
Technical details
An out-of-bounds (OOB) read vulnerability exists in libheif's `Track::init_sample_timing_table()` within `libheif/sequences/track.cc`. The flaw occurs when the number of chunks defined in the `stco` (Sample Table Chunk Offset) box is less than the number of samples in the `stsz` (Sample Size) box, causing an OOB chunk index to be stored in `m_presentation_timeline`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` triggers a heap-buffer-overflow when reading from the `m_chunks` vector using the invalid index. This requires a user to open a maliciously crafted HEIC/AVIF file. The issue is resolved in version 1.22.0 by improving validation of sample-to-chunk mappings.
Affected products
- strukturag libheif < 1.22.0
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE published to NVD