Executive brief
libheif, a library used for decoding and encoding HEIF and AVIF image files, is vulnerable to a crash when processing specially crafted image files. An attacker could provide a malformed image that, when opened by an application using this library, causes the application to shut down unexpectedly. This results in a denial-of-service, affecting the availability of image viewing or processing services.
Technical details
A NULL pointer dereference exists in libheif versions prior to 1.22.0 within the `heif_image_handle_get_image_tiling()` C API. The vulnerability occurs when a malformed uncompressed HEIF image item contains an associated `uncC` (uncompressed configuration) property but lacks the required `ispe` (image spatial extents) property. In `ImageItem_uncompressed::get_heif_image_tiling()`, the code assumes both properties are present; in release builds where assertions are disabled, the missing `ispe` property results in a NULL pointer dereference at offset `0xa8`. An attacker can trigger this by providing a crafted HEIF file to any application utilizing the library's tiling API, resulting in a process crash. The issue is fixed in version 1.22.0.
Affected products
- strukturag libheif < 1.22.0
Timeline
- 2026-05-18: disclosed: Initial issue reported on GitHub
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: patched: Version 1.22.0 released and CVE published