AIKIDO-2026-812768

TL;DR

The uncompressed (unci) mixed-interleave decoder in libheif allocates each destination chroma plane from its own component bit depth but writes both chroma planes using the first chroma entry's byte width. A crafted HEIF that declares mismatched Cb/Cr bit depths (for example 8-bit Y with 16-bit Cb and 8-bit Cr) in a 4:2:0 mixed-interleave image drives memcpy_to_native_endian past the smaller plane, corrupting the heap with file-controlled data. This yields file-controlled out-of-bounds writes during ordinary decoding. The fix tracks a per plane byte width so each chroma plane is written with its own sample size.