Executive brief
libheif is a decoder and encoder for HEIF, HEIC, and AVIF image formats commonly used in modern devices and applications. A malicious image file can exploit the way libheif handles alpha transparency layers, causing it to write data beyond allocated memory boundaries. An attacker who tricks a user into opening a crafted image file can crash the application or potentially execute arbitrary code on the victim's system.
Technical details
The vulnerability exists in HeifPixelImage::scale_nearest_neighbor() which allocates an 8-bit alpha plane buffer but then writes 10-bit or 12-bit sample values into it when processing nested iden and auxl item references that create duplicate alpha planes with mismatched bit depths. The heap out-of-bounds write is triggered during image decode and is controlled by the image geometry and encoded sample values. This issue is fixed by validating and rejecting duplicate or mismatched-size alpha planes during image decoding.
Affected products
- strukturag libheif 1.22.0 to 1.23.1
Timeline
- 2026-09-18: disclosed: Published on NVD
- 2026-08-23: patched: Fixed in version 1.23.2