PT-2026-49257 · Julia · Libheif Jll

Published 2026-06-05 · Updated 2026-06-05

OSV

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->get num samples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments current chunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heif context read from file) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.

Fix

Related Identifiers

JLSEC-2026-574

Affected Products

Libheif Jll

References · 3

• https://osv.dev/vulnerability/JLSEC-2026-574 · Vendor Advisory
• https://github.com/strukturag/libheif/security/advisories/GHSA-xj92-xjff-h8w3 · Note
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 · Note