PT-2024-7935 · Libheif+6 · Libheif+6
Flyyee
·
Published
2024-10-15
·
Updated
2025-01-29
·
CVE-2024-41311
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Libheif version 1.17.6
Description
The issue is related to the
ImageOverlay::parse() function in the libheif decoder and encoder for video and photo file formats. It involves an out-of-bounds read and write due to insufficient checks when decoding a HEIF file containing an overlay image with forged offsets. This could allow a remote attacker to access confidential information.Recommendations
For Libheif version 1.17.6, consider disabling the
ImageOverlay::parse() function until a patch is available to prevent potential out-of-bounds read and write exploits. Restrict access to HEIF files containing overlay images to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Out of bounds Read
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Libheif