Threats Tagged 'cve-2026-48029'

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

Multiple security vulnerabilities have been addressed in libheif with the release of version 1.23.0. These include heap buffer over-reads, out-of-bounds reads and writes, integer overflows, infinite loop denial-of-service, null pointer dereferences, and information disclosure issues. The vulnerabilities arise from malformed or crafted HEIF image files and affect various components such as overlay compositing, sample duration lookup, mask image decoding, and metadata parsing. The update also includes new API functions and other feature enhancements.

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.