Vulnerability · Published May 22, 2026 · Assigned by GitHub_M
CVE-2026-41071libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count
Medium 5.1
In plain English
A medium-severity out-of-bounds read in libheif from strukturag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->get_num_samples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments current_chunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heif_context_read_from_file) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libheif | no fix listed | DEBIAN-CVE-2026-41071 |
| Debian:14 | libheif | 1.23.1-1 | DEBIAN-CVE-2026-41071 |
| Ubuntu:25.10 | libheif | 1.20.2-1ubuntu0.4 | UBUNTU-CVE-2026-41071 |
| Ubuntu:26.04:LTS | libheif | 1.21.2-3ubuntu0.1 | UBUNTU-CVE-2026-41071 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| strukturag | libheif | < 1.22.0 |
Weakness: CWE-125 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/strukturag/libheif/security/advisories/GHSA-xj92-xjff-h8w3 x_refsource_CONFIRM
- https://github.com/strukturag/libheif/releases/tag/v1.22.0 x_refsource_MISC