libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->get_num_samples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments current_chunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heif_context_read_from_file) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade libheif-plugin-jpegdecUpgrade libheif-devUpgrade libheif-plugin-dav1dUpgrade libheif-plugin-rav1eUpgrade libheif-plugin-aomdecUpgrade libheif-plugin-j2kdecUpgrade libheif-plugin-aomencUpgrade libheif-dev (Ubuntu Pro)Upgrade heif-gdk-pixbufUpgrade libheif1 (Ubuntu Pro)Upgrade libheif-plugin-jpegencUpgrade heif-gdk-pixbuf (Ubuntu Pro)Upgrade libheif-plugin-svtencUpgrade heif-viewUpgrade heif-thumbnailer (Ubuntu Pro)Upgrade libheif-plugin-libde265Upgrade libheif-plugin-kvazaarUpgrade libheif-plugins-allUpgrade libheif-plugin-ffmpegdecUpgrade libheif1Upgrade libheif-plugin-j2kencUpgrade libheif-plugin-x265Upgrade heif-thumbnailer | Jun 21, 2026 | Jun 18, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub