PT-2026-49257 · Julia · Libheif Jll

Publicado 2026-06-05 · Atualizado 2026-06-05

OSV

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->get num samples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments current chunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heif context read from file) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.

Correção

Identificadores relacionados

JLSEC-2026-574

Produtos afetados

Libheif Jll

Referências · 3

• https://github.com/strukturag/libheif/security/advisories/GHSA-xj92-xjff-h8w3 · Nota
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 · Nota
• https://osv.dev/vulnerability/JLSEC-2026-574 · Aviso do Fabricante