Description

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-07-22T15:17:18.357Z",
  "pubdate": "2026-07-22T15:17:18.357Z",
  "executiveSummary": "A heap out-of-bounds read vulnerability has been identified in libheif, an open-source HEIF and AVIF file format decoder and encoder. The vulnerability resides specifically within the ImageItem_Grid::decode_grid_tile function and is triggered via an irot-induced tile-coordinate underflow. This security flaw impacts software utilizing libheif versions 1.19.0 through 1.21.2. Successful exploitation of this vulnerability can lead to information disclosure or application crashes, potentially resulting in a denial of service condition. The risk implications involve processing untrusted HEIF or AVIF image files supplied by an attacker. Attacker capabilities include crafting malicious image files containing specific transformation metadata that manipulate tile coordinates beyond allocated memory boundaries. Exploitation requirements mandate that a victim opens or processes a maliciously crafted image file using a vulnerable instance of the libheif library.",
  "technicalDetails": "The vulnerability is classified as a heap out-of-bounds read, originating from improper handling of image transformation metadata within the HEIF and AVIF file decoding pipeline. The root cause is an irot-induced tile-coordinate underflow occurring inside the ImageItem_Grid::decode_grid_tile function. When libheif processes grid-based image items that incorporate image rotation (irot) properties, calculations involving tile coordinates fail to adequately validate lower bounds, leading to an arithmetic underflow.\nThe vulnerable component is the libheif parsing and decoding engine, specifically located in the file and function responsible for assembling grid tiles. Affected versions include libheif 1.19.0 up to and including version 1.21.2. The issue requires no authentication or special privileges to exploit, as it can be triggered locally by parsing a maliciously crafted file, or remotely if exposed via a web application, media parser, or thumbnail generation service that processes untrusted image uploads.\nThe attack flow proceeds as follows: First, the attacker constructs a malformed HEIF or AVIF image file containing manipulated grid dimensions and rotation (irot) metadata. Second, the victim or an automated processing system feeds this crafted file into an application utilizing a vulnerable version of libheif. Third, during the decoding phase, libheif invokes ImageItem_Grid::decode_grid_tile to reconstruct the image grid. Fourth, the malicious irot metadata forces a coordinate calculation that underflows, resulting in an invalid, highly negative or wrapped-around coordinate value used as an index offset. Fifth, when the decoding routine attempts to read pixel or tile data from the heap using this underflowed coordinate, it accesses memory locations preceding the allocated heap buffer, triggering a heap out-of-bounds read. The payload behavior results in an immediate memory access violation, typically causing the host process to crash, or potentially leaking adjacent heap memory contents if the read data is reflected back or processed further."
}