Heap-based Buffer Overflow Affecting libheif package, versions [0,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Heap-based Buffer Overflow vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-CONAN-LIBHEIF-19268306
- published26 Aug 2026
- disclosed26 Aug 2026
- creditrootxharsh
Introduced: 26 Aug 2026
New CVE NOT AVAILABLE CWE-122 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to duplicate Alpha planes in HeifPixelImage::transfer_channel_from_image_as() and scale_nearest_neighbor() in libheif/image/pixelimage.cc and libheif/image-items/image_item.cc. An attacker can trigger an out-of-bounds write by supplying a crafted HEIC/HEIF/AVIF file with nested iden and auxl item references that produce multiple Alpha planes of different sizes or bit depths during image decoding.
When heif_decode_image() scales the decoded image, the code sizes the destination Alpha plane from the first matching channel but still iterates and writes every stored plane, so a later higher-bit-depth Alpha plane can write 16-bit samples into an 8-bit allocation. This can crash the application and can be exploited for heap corruption in software that decodes attacker-controlled images.