Out-of-Bounds Read Vulnerability in Microsoft HEIF Image Extensions
CVE-2025-62821

9.1CRITICAL

Key Information:

Vendor

Microsoft
Status
HEIF Image Extensions
Vendor
CVE Published:
19 June 2026

What is CVE-2025-62821?

The Microsoft HEIF Image Extensions version 1.2.22.0 is susceptible to an out-of-bounds read vulnerability. This issue arises when the function CHEIFItemInfoEntry_GetDataSize returns a successful status while inaccurately reporting a data size of zero. Consequently, this leads to an erroneous 1-byte memory allocation. During subsequent operations, particularly in the CopyPixels function, the calculation of copy_size derives from stride and roi_height without validating the length of the source buffer prior to executing a memmove operation. This oversight could potentially be exploited, resulting in various security implications.

References

https://github.com/hyunjungg/CVE-2025-62821

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.