libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libheif | Jan 26, 2026 | Dec 29, 2025 |
| Amazon_linux_2023 | — | Upgrade libheif-debuginfoUpgrade heif-pixbuf-loaderUpgrade heif-pixbuf-loader-debuginfoUpgrade libheifUpgrade libheif-debugsourceUpgrade libheif-develUpgrade libheif-tools-debuginfoUpgrade libheif-tools | Jan 26, 2026 | Dec 29, 2025 |
| Debian | — | Upgrade libheif | Aug 9, 2026 | Aug 9, 2026 |
| Ubuntu | — | Upgrade libheif1 (Ubuntu Pro)Upgrade libheif1 | Jan 13, 2026 | Dec 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub