PT-2026-42834 · Libheif · Libheif

M1-Llie · Published 2026-05-22 · Updated 2026-05-28 · CVE-2026-41071

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.0

Description A heap-buffer-overflow (out-of-bounds read) occurs in the SampleAuxInfoReader constructor when parsing a crafted HEIF sequence file. The issue arises because the constructor iterates over the number of samples declared in the saiz box using saiz->get num samples() without validating that this count is consistent with the number of chunks in the chunks vector. Consequently, if the saiz box declares more samples than the chunks cover, the loop increments current chunk beyond the size of the chunks vector, leading to an out-of-bounds read. This is triggered during file parsing via the heif context read from file function without requiring user interaction.

Recommendations Update to version 1.22.0.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-41071

OPENSUSE-SU-2026:10878-1

Affected Products

Libheif

References · 27

• https://github.com/strukturag/libheif/security/advisories/GHSA-xj92-xjff-h8w3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41071 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41071 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41071 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41071 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41071 · Security Note
• https://ubuntu.com/security/CVE-2026-41071 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10878-1 · Vendor Advisory
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 · Note
• https://suse.com/security/cve/CVE-2026-47709 · Note
• https://suse.com/security/cve/CVE-2026-32741 · Note
• https://suse.com/security/cve/CVE-2026-41071 · Note
• https://suse.com/security/cve/CVE-2026-41069 · Note
• https://suse.com/security/cve/CVE-2026-47247 · Note
• https://t.me/CVEtracker/54676 · Telegram Post