Executive brief
libheif is a library that decodes and encodes HEIF and AVIF image formats. A flaw in the uncompressed tile decoder allows a maliciously crafted image to cause an integer overflow, leading to an out-of-bounds memory read that can crash applications processing individual image tiles. Whole-image decoding is not affected. The issue is fixed in version 1.23.3.
Technical details
An integer overflow in unc_decoder::get_compressed_image_data_uncompressed() allows range_start_offset + range_size to wrap in uint64_t arithmetic when processing a crafted uncompressed tile grid, bypassing bounds checking. This permits heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and excessive length, causing an out-of-bounds read. The vulnerability is triggered only in the no-icef full-item code path when decoding individual tiles via heif_image_handle_decode_image_tile().
Affected products
- strukturag libheif 1.19.0 through 1.23.2
Timeline
- 2026-09-18: disclosed
- 2026-09-01: patched: Fixed in version 1.23.3