Heap Exposure Vulnerability in libheif HEIF and AVIF Decoder by StrukturAG

CVE-2026-49271

What is CVE-2026-49271?

The libheif library, which is used for decoding and encoding HEIF and AVIF file formats, has a vulnerability related to its uncompressed HEIF decoder. Specifically, prior to version 1.22.1, it improperly validates compressed-unit offsets. This can lead to a situation where an attacker can craft a malformed HEIF file, causing the decoder to perform unsafe memory operations and leading to an out-of-bounds heap read. This issue can potentially allow attackers to exploit the system reaction to this vulnerability, including crashing the application or revealing sensitive information.

References