AIKIDO-2025-11011
github.com/strukturag/libheif is vulnerable to Out-of-bounds Read
63
Medium Risk
This Affects:
github.com/strukturag/libheifTL;DR
A crafted HEIF file that exercises the overlay image item path triggers a heap buffer over-read in HeifPixelImage::overlay(). The function calculates a negative row length—likely due to an unclipped overlay rectangle or invalid offsets—which underflows when converted to size_t and is then passed to memcpy. This results in an excessively large read beyond the bounds of the source plane, leading to a crash.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/strukturag/libheif is vulnerable to Out-of-bounds Read in versions 0.0.1 - 1.20.2.
How to fix this
Upgrade the github.com/strukturag/libheif library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant