Out-of-Bounds Read Vulnerability in libheif Product from Struktur AG

CVE-2026-41069

What is CVE-2026-41069?

A vulnerability exists in libheif, a widely used HEIF and AVIF file format decoder and encoder, where a malformed HEIF sequence file can lead to an out-of-bounds read in the core sequence parsing logic. Specifically, configurations with a stco.entry_count of zero can still pass validation, but combined with non-zero saiz.sample_count, this results in a dereference of an empty chunk. This can be exploited to trigger denial-of-service conditions. Users are encouraged to update to version 1.22.0 or later to mitigate this risk.

References