libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | amazon-linux-2023-upgrade-heif-pixbuf-loaderamazon-linux-2023-upgrade-heif-pixbuf-loader-debuginfoamazon-linux-2023-upgrade-libheifamazon-linux-2023-upgrade-libheif-debuginfoamazon-linux-2023-upgrade-libheif-debugsourceamazon-linux-2023-upgrade-libheif-develamazon-linux-2023-upgrade-libheif-toolsamazon-linux-2023-upgrade-libheif-tools-debuginfo | Jul 22, 2026 | Jul 21, 2026 | |
| Ubuntu | ubuntu-upgrade-heif-gdk-pixbufubuntu-upgrade-heif-thumbnailerubuntu-upgrade-heif-viewubuntu-upgrade-libheif-devubuntu-upgrade-libheif-examplesubuntu-upgrade-libheif-plugin-aomdecubuntu-upgrade-libheif-plugin-aomencubuntu-upgrade-libheif-plugin-dav1dubuntu-upgrade-libheif-plugin-ffmpegdecubuntu-upgrade-libheif-plugin-j2kdecubuntu-upgrade-libheif-plugin-j2kencubuntu-upgrade-libheif-plugin-jpegdecubuntu-upgrade-libheif-plugin-jpegencubuntu-upgrade-libheif-plugin-kvazaarubuntu-upgrade-libheif-plugin-libde265ubuntu-upgrade-libheif-plugin-rav1eubuntu-upgrade-libheif-plugin-svtencubuntu-upgrade-libheif-plugin-x265ubuntu-upgrade-libheif-plugins-allubuntu-upgrade-libheif1 | Jul 12, 2026 | Jul 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub