VulnerabilityPublished 13 Apr 2026Updated 13 Aug 2026

Libultrahdr: Heap-buffer-overflow

Affects libultrahdrSource GCVE Database

Severity

Medium

Rated by Threat Radar

Data as of 13 Aug 2026, 17:47 UTC

What to do

Affected software

Product	Affected	Fixed in
OSS-Fuzzlibultrahdr`pkg:generic/libultrahdr`Other threats	Affected v1.3.1 – v1.5.1 >=cff53d31267fd8396ecf6bf03f212fc8387f5672 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until a fix is available, users should consider avoiding processing untrusted ICC color gamut data with affected versions of libultrahdr or apply additional sandboxing or memory protection measures where feasible.

Description

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=501676165 ``` Crash type: Heap-buffer-overflow READ 1 Crash state: ultrahdr::IccHelper::readIccColorGamut ultrahdr::JpegR::decodeJPEGR uhdr_decode ```

Impact

This vulnerability can cause heap memory corruption due to out-of-bounds reads, potentially leading to application crashes or undefined behavior. The absence of known exploits in the wild suggests limited current risk, but the vulnerability could be leveraged in targeted attacks if exploited.

Summary

The libultrahdr library suffers from a heap-buffer-overflow vulnerability triggered in the ultrahdr::IccHelper::readIccColorGamut function. The overflow occurs during the processing of ICC color gamut data, as identified by OSS-Fuzz. The crash involves reading beyond allocated heap memory, which may lead to memory corruption or application crashes. Affected versions explicitly include 1.3.1, 1.4.0, 1.5.0, 1.5.1, and all versions from the specified commit hash onward. There is no available information about a patch or fix from the vendor, and no active exploitation has been observed.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=501676165 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Aug 2026, 18:07 UTC

Technical details

References

Community reviews

Related threats