Executive brief
libheif is a software library used by many applications to process HEIF and AVIF image files. A flaw in how the library handles image masks allows a specially crafted image file to cause a memory error. If a user opens such a file, the application could crash or potentially leak sensitive information from its memory, though this typically requires the application to be configured to handle very high-resolution images.
Technical details
An integer overflow exists in `libheif/region.cc` within the inline mask parsing logic. The vulnerability occurs when calculating `additionalBytesRequired = width * height / 8`. Because `width` and `height` are 32-bit unsigned integers parsed directly from the file, their product can exceed `UINT32_MAX`, resulting in a truncated value and an undersized buffer allocation. When the mask data is subsequently processed as a full-sized bitmap, an out-of-bounds memory access occurs. Exploitation requires a user to open a crafted HEIF file and typically requires the application to have disabled or increased default security limits (`max_image_size_pixels`). This can result in a denial-of-service (crash) or potential information disclosure via OOB heap reads. The issue is fixed in version 1.22.0.
Affected products
- strukturag libheif <= 1.21.2
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE published to NVD
- 2026-07-21: patched: Version 1.22.0 released