libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libheif-debugsourceUpgrade libheifUpgrade heif-pixbuf-loader-debuginfoUpgrade libheif-develUpgrade libheif-toolsUpgrade heif-pixbuf-loaderUpgrade libheif-debuginfoUpgrade libheif-tools-debuginfo | Jun 9, 2026 | May 19, 2026 |
| Debian | — | Upgrade libheif | Aug 9, 2026 | Aug 9, 2026 |
| Ubuntu | — | Upgrade libheif-plugin-libde265Upgrade libheif-plugin-ffmpegdecUpgrade libheif-plugin-j2kdecUpgrade libheif-plugins-allUpgrade libheif-plugin-kvazaarUpgrade libheif-plugin-j2kencUpgrade libheif1 (Ubuntu Pro)Upgrade libheif-plugin-dav1dUpgrade libheif-plugin-svtencUpgrade heif-viewUpgrade heif-gdk-pixbufUpgrade heif-thumbnailerUpgrade libheif-plugin-x265Upgrade heif-thumbnailer (Ubuntu Pro)Upgrade heif-gdk-pixbuf (Ubuntu Pro)Upgrade libheif-plugin-jpegdecUpgrade libheif1Upgrade libheif-plugin-jpegencUpgrade libheif-devUpgrade libheif-plugin-aomencUpgrade libheif-plugin-aomdecUpgrade libheif-plugin-rav1eUpgrade libheif-dev (Ubuntu Pro) | Jun 21, 2026 | Jun 18, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub