Executive brief
libheif is a HEIF and AVIF image decoder and encoder library used by media applications and image processors. A flaw in the region mask writer API allows code that constructs region metadata to read beyond allocated heap memory, potentially disclosing sensitive data or crashing the application. File parsing is unaffected because it validates mask sizes correctly.
Technical details
The heif_region_item_add_region_inline_mask_data() function in the writer API accepts a caller-supplied mask_data_len parameter without validating it matches the expected size derived from region geometry (width*height+7)/8 bytes. Later, heif_region_get_inline_mask_image() reads from the undersized buffer using the geometry-derived length, causing an out-of-bounds heap read that copies adjacent memory into the returned mask image. Attack requires use of the writer API; file parsing validates mask sizes and is not affected.
Affected products
- strukturag libheif prior to 1.23.2
Timeline
- 2026-09-18: disclosed
- 2026-08-24: patched: Fixed in version 1.23.2