Out-of-bounds Write Affecting libheif package, versions [0,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CONAN-LIBHEIF-19268309
- published26 Aug 2026
- disclosed26 Aug 2026
- creditUnknown
Introduced: 26 Aug 2026
New CVE NOT AVAILABLE CWE-125 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Out-of-bounds Write through ImageItem::decode_image() in libheif/image-items/image_item.cc. An attacker can trigger memory corruption by supplying a malformed HEIC image with mismatched alpha-plane geometry that is decoded and scaled against the wrong dimensions. This can crash the decoder or be leveraged for remote code execution when an application processes the crafted image.