Out-of-bounds Write Affecting strukturag/libheif package, versions [,1.23.2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-STRUKTURAGLIBHEIF-19268308
- published26 Aug 2026
- disclosed26 Aug 2026
- creditUnknown
Introduced: 26 Aug 2026
New CVE NOT AVAILABLE CWE-125 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade strukturag/libheif to version 1.23.2 or higher.
Overview
Affected versions of this package are vulnerable to Out-of-bounds Write through ImageItem::decode_image() in libheif/image-items/image_item.cc. An attacker can trigger memory corruption by supplying a malformed HEIC image with mismatched alpha-plane geometry that is decoded and scaled against the wrong dimensions. This can crash the decoder or be leveraged for remote code execution when an application processes the crafted image.