libheif is a library for decoding and encoding HEIF and AVIF image formats. Versions up to 1.21.2 contain a heap-based buffer overflow in the MaskImageCodec::decode_mask_image() function. The vulnerability arises because the function copies data from an iloc extent field, which is attacker-controlled, into a pixel buffer without verifying that the data size fits within the buffer. Specifically, when the mask image properties specify bits_per_pixel = 8 and an even width ≥ 64, the stride equals the width, and the unchecked memcpy operation can overflow the heap buffer. This flaw allows an attacker to craft a malicious HEIF file that triggers the overflow. The issue has been resolved in libheif version 1.22.0.

Exploitation of this vulnerability can lead to a heap-based buffer overflow, which may cause application crashes or potentially enable denial of service. The CVSS vector indicates no confidentiality impact, low integrity impact, but high availability impact. There are no reports of active exploitation in the wild. The vulnerability requires the victim to decode a maliciously crafted HEIF file containing a mask image with specific properties.

A fix for this vulnerability is available in libheif version 1.22.0. Users and vendors should upgrade to version 1.22.0 or later to remediate this issue. Since this is a library vulnerability, applications using libheif should update their dependencies accordingly. No additional mitigations are specified or required beyond applying the official fix.