Description

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T22:17:02.720Z",
  "pubdate": "2026-08-18T22:17:02.720Z",
  "executiveSummary": "A vulnerability exists in the libheif library, specifically affecting versions 1.23.0 and earlier, where a crafted HEIF or AVIF file can trigger an integer underflow and subsequent crash or memory corruption. The vulnerability stems from improper handling of image dimensions when a clean aperture box is maliciously crafted to reduce image dimensions to zero. When an application calls the function heif_image_handle_get_image_tiling(handle, 1, &tiling) using a specially crafted file, an invalid state is reached during image transformation processing. The impact of this vulnerability varies depending on the build configuration; debug builds will encounter an assertion failure resulting in application abortion, whereas release builds can return corrupted crop data and zero-width tiling results, potentially leading to downstream memory corruption or denial of service conditions. Exploitation requires an attacker to supply a malformed HEIF or AVIF file to a vulnerable application processing images, necessitating user interaction or ingestion of untrusted file data.",
  "technicalDetails": "The root cause of this vulnerability lies in redundant and unsafe image transformation processing within libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. Specifically, the method ImageItem::get_heif_image_tiling() returns image dimensions that have already undergone transformation. However, process_image_transformations_on_tiling() subsequently applies the clean aperture transformation a second time. This redundant application passes a zero value into Box_clap::left_rounded(0). Inside this function, the image width calculation subtracts one from zero, triggering an integer underflow. This underflow constructs an invalid Fraction object containing the value Fraction(0xFFFFFFFF, 2). In debug builds, safety checks catch this anomaly, reaching an assertion failure and aborting execution. In release builds, the underflow produces a corrupt crop and a zero-width tiling result, which can propagate through the rendering or encoding pipeline and destabilize the host application. The affected component is the image transformation and tiling subsystem of libheif. Exploitation is triggered locally or remotely via network exposure depending on how the application ingests untrusted HEIF and AVIF files. No authentication or elevated privileges are required to supply the malformed file, making it accessible to unauthenticated attackers capable of delivering malicious media files to the parser."
}