Executive brief
libheif is a widely used software library for decoding and encoding HEIF and AVIF image files. A vulnerability in how the library handles rotated images allows an attacker to crash applications that process these images or potentially access sensitive information from the computer's memory. This could lead to service outages or data exposure if a user is tricked into opening a specially crafted image file.
Technical details
A heap out-of-bounds (OOB) read exists in libheif's ImageItem_Grid::decode_grid_tile function. The vulnerability is caused by an integer underflow in ImageItem::transform_requested_tile_position_to_original_tile_position when processing 'irot' (rotation) properties (90, 180, or 270 degrees) where rows and columns are unequal. The library fails to validate caller-supplied tile coordinates against post-rotation bounds before performing subtraction, resulting in a massive unsigned integer value. This value is subsequently used as an index for m_grid_tile_ids without bounds checking in release builds, leading to a SIGSEGV or OOB read. The issue is fixed in version 1.22.0.
Affected products
- strukturag libheif 1.19.0 - 1.21.2
Timeline
- 2026-05-18: patched: Fix committed to repository
- 2026-05-20: disclosed: Security advisory published on GitHub
- 2026-07-22: advisory: NVD publication date