GHSA-2xp9-vwfh-vxw4

Several vulnerabilities (two rated critical under CVSSv3) have been discovered and fixed in the upstream libheif dependency. They can lead to remote code execution (RCE) on glibc-based Linux under certain conditions.

Vulnerability in libheif (up to 1.23.0) allows application crash via a crafted HEIF sequence that does not register sequence tracks, leading to assertion or undefined behavior when calling heif_context_get_track.

Vulnerability in libheif (versions 1.19.0 to 1.23.1) causing application crash when decoding a crafted uncompressed HEIF image with zlib compression. An offset calculation error leads to out-of-bounds read and crash.

Vulnerability in libheif (up to 1.23.0) allows heap corruption via a crafted image sequence with mismatched alpha plane dimensions, leading to out-of-bounds write during encoding.

Vulnerability in libheif (up to 1.23.0) allows crash or corrupt tiling results via a crafted HEIF/AVIF file with a clean aperture box that reduces dimensions to zero, causing underflow and assertion or incorrect results.

libheif from 1.19.0 to 1.23.0 has a vulnerability allowing unbounded heap allocation when processing a crafted HEIF sequence with msf1 brand. Box_stsz::parse() applies max_sequence_frames only to variable-size samples, and Track::load() uses 32-bit arithmetic that can bypass consistency checks. This can lead to gigabytes of memory allocation, crashing or stalling the process.

libheif versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

Vulnerability in libheif before version 1.22.0. Decoding a malicious HEIF file without an `ispe` property (but with `uncC`) causes a crash in `heif_image_handle_get_image_tiling()` – via assertion in debug builds or null pointer read in release/ASan builds.

Vulnerability in libheif before version 1.22.0 causes a heap buffer overflow when reading HEIF/AVIF files. The Track::init_sample_timing_table() function stores an invalid chunk index, leading to an out-of-bounds read.

Vulnerability in libheif before version 1.22.0. The fix for CVE-2026-3949 introduced an integer overflow in the security check, allowing bypass and triggering an out-of-bounds heap read via a crafted HEIF file with a VVC track.