libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libheif | Jun 18, 2026 | May 19, 2026 |
| Ubuntu | — | Upgrade libheif-plugin-x265Upgrade libheif-plugin-rav1eUpgrade libheif-plugin-aomdecUpgrade libheif-plugin-dav1dUpgrade heif-gdk-pixbufUpgrade libheif-plugin-aomencUpgrade heif-thumbnailer (Ubuntu Pro)Upgrade libheif-plugin-kvazaarUpgrade libheif-plugin-j2kdecUpgrade libheif-devUpgrade heif-thumbnailerUpgrade libheif-plugin-ffmpegdecUpgrade libheif1 (Ubuntu Pro)Upgrade libheif-plugin-jpegencUpgrade libheif-plugin-libde265Upgrade heif-viewUpgrade libheif-dev (Ubuntu Pro)Upgrade libheif-plugin-svtencUpgrade libheif-plugin-jpegdecUpgrade libheif-plugin-j2kencUpgrade libheif1Upgrade libheif-plugins-allUpgrade heif-gdk-pixbuf (Ubuntu Pro) | Jun 21, 2026 | Jun 18, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub