CVE-2026-41069
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
An out-of-bounds read vulnerability has been found in libheif versions 1.21.2 and prior during HEIF sequence parsing. A malformed file can cause denial of service (DoS).
Risk Assessment
The organization is at risk of DoS attacks via malicious HEIF files, potentially disrupting applications using libheif.
Recommendation
Update libheif to version 1.21.3 or later, which contains the fix.
Other vulnerabilities in libheif
See all- CVE-2026-62377Medium
Vulnerability in libheif (up to 1.23.0) allows application crash via a crafted HEIF sequence that does not register sequence tracks, leading to assertion or undefined behavior when calling heif_context_get_track.
- CVE-2026-62292High
Vulnerability in libheif (versions 1.19.0 to 1.23.1) causing application crash when decoding a crafted uncompressed HEIF image with zlib compression. An offset calculation error leads to out-of-bounds read and crash.
- CVE-2026-62291Medium
Vulnerability in libheif (up to 1.23.0) allows heap corruption via a crafted image sequence with mismatched alpha plane dimensions, leading to out-of-bounds write during encoding.
- CVE-2026-62289Medium
Vulnerability in libheif (up to 1.23.0) allows crash or corrupt tiling results via a crafted HEIF/AVIF file with a clean aperture box that reduces dimensions to zero, causing underflow and assertion or incorrect results.
- CVE-2026-50142High
libheif from 1.19.0 to 1.23.0 has a vulnerability allowing unbounded heap allocation when processing a crafted HEIF sequence with msf1 brand. Box_stsz::parse() applies max_sequence_frames only to variable-size samples, and Track::load() uses 32-bit arithmetic that can bypass consistency checks. This can lead to gigabytes of memory allocation, crashing or stalling the process.
- CVE-2026-48029High
libheif versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.
- CVE-2026-47709Medium
Vulnerability in libheif before version 1.22.0. Decoding a malicious HEIF file without an `ispe` property (but with `uncC`) causes a crash in `heif_image_handle_get_image_tiling()` – via assertion in debug builds or null pointer read in release/ASan builds.
- CVE-2026-47254Medium
Vulnerability in libheif before version 1.22.0 causes a heap buffer overflow when reading HEIF/AVIF files. The Track::init_sample_timing_table() function stores an invalid chunk index, leading to an out-of-bounds read.
- CVE-2026-47251Medium
Vulnerability in libheif before version 1.22.0. The fix for CVE-2026-3949 introduced an integer overflow in the security check, allowing bypass and triggering an out-of-bounds heap read via a crafted HEIF file with a VVC track.
- CVE-2026-47247High
Two bugs in libheif prior to version 1.22.0 chain to leak process heap memory as visible pixel values in decoded grid images. An attacker uploading a crafted AVIF/HEIC file to a server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data, including library function pointers sufficient to defeat ASLR, from publicly downloadable transcoded JPEG/PNG/WebP output.
Original NVD description (English source)
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with saiz.sample_count > 0 the SampleAuxInfoReader constructor still enters its loop. This leads to an out-of-bounds dereference on the empty chunks[0] in chunked mode.